Topic starter
11/11/2026 6:02 pm
TL;DR: Attack-path prioritisation can still miss the route an active threat actor is using, according to Dataminr, because exposure counts and standalone risk scores do not test current control effectiveness together. For practitioners, the decision point shifts from ranking weaknesses to proving whether today’s controls stop a live attack path.
Editorial analysis by NHI Mgmt Group, based on content published by Dataminr: “Why PTEM Is Different: Threat-First, All the Way to a Decision”.
Key questions
Q: Why can risk scores miss live attack paths?
A: Risk scores can miss live attack paths because they usually estimate severity from static asset or vulnerability data, not whether an attacker can combine reachable exposures, valid credentials, and privilege escalation in sequence.
Q: How does exposure management differ from attack-path validation?
A: Exposure management identifies and ranks weaknesses, misconfigurations, and reachable assets, while attack-path validation proves whether those exposures form a usable route to a valuable target.
Q: How do I validate attack paths in a CTEM programme?
A: Validate attack paths by starting from a real objective, then tracing reachable steps through identities, permissions, network routes, and exposed services to see whether an attacker can actually progress.
Practitioner guidance
- Build attack-path validation into remediation triage Rank exposures only after checking whether the most likely attacker path is still open and whether current controls actually block it.
- Tie risk scores to live control state Refresh quantified risk views with current compensating controls and live threat activity before using them for board or funding decisions.
- Define acceptance thresholds in advance Set decision thresholds for fix, defer, or accept so the team can act consistently when a quantified exposure crosses a business limit.
Bottom line: Exposure management can improve visibility without proving that the attacker route to impact has been broken.
Glossary terms: Attack path, Threat Exposure Management, Continuous Threat Exposure Management, Risk Quantification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Attack-path validation is the missing governance layer: exposure management can tell teams what is open, but not whether the route a real attacker would use has been broken. That makes exposure counts a partial control signal rather than a governance answer. For IAM, PAM and NHI programmes, the key question is whether privilege pathways and compensating controls have been tested against a live threat model, not whether the inventory looks cleaner.
A question worth separating out:
Q: When should teams accept an exposure instead of fixing it?
A: Teams accept an exposure when the residual risk stays below the business threshold after considering likelihood, impact, compensating controls, and the cost or delay of remediation. That decision should be explicit, time-bound, and owned, with monitoring, a review date, and a record of why the exposure is being tolerated rather than fixed.
👉 Read our full editorial: Attack-path validation matters more than exposure scores alone