What do security teams get wrong about attack graphs and exposure management?

Why Security Teams Misread Attack Graphs and Exposure Data

Attack graphs and exposure management platforms are often adopted as visibility layers, but the real security question is whether they change priority. A graph that shows every path without ranking the paths that matter creates noise, not control. That gap is familiar in NHI-driven incidents, where exposed secrets, over-privileged accounts, and weak rotation create movement options that are invisible until an attacker chains them together. NHIMG’s The State of Non-Human Identity Security reports that lack of credential rotation is the top cause of NHI-related attacks for 45% of organisations, which explains why static hygiene metrics rarely match real attacker behavior.

Practitioners also overestimate how well traditional asset-centric views map to exposure risk. A host can be patched and still be one credential away from privilege escalation, or one misconfigured OAuth app away from lateral movement. That is why current guidance from the NIST Cybersecurity Framework 2.0 and ATT&CK-style analysis is best treated as a decision aid, not a reporting output. In practice, many security teams discover the attack path only after the attacker has already used it to reduce dwell time.

How Attack Graphs Should Drive Remediation Decisions

Useful exposure management starts with attacker objectives, not with inventory completeness. The graph should answer three practical questions: which combinations of exposure create a realistic path, which identities or secrets unlock that path, and which single remediation breaks the path with the least operational cost. That means weighting nodes by privilege, reachability, trust relationships, and exploitability rather than by raw count. A weak public endpoint matters far less if it cannot reach a credentialed workload; the same weakness becomes critical if it can touch a token store or cloud control plane.

Good programmes connect graph findings to existing identity controls and NHI lifecycle discipline. NHIMG’s NHI Lifecycle Management Guide is relevant here because exposed service accounts, stale tokens, and unmanaged certificates are exactly the assets that turn a theoretical path into an incident. External mappings such as the MITRE ATT&CK Enterprise Matrix help teams translate path segments into likely attacker techniques, while the NIST SP 800-53 Rev 5 Security and Privacy Controls provides the control language for remediation tracking.

• Prioritise paths that end at privileged NHI or cloud control-plane access.
• Rank exposures by reachable blast radius, not by vulnerability severity alone.
• Use graph output to choose the first fix that removes multiple paths at once.
• Recalculate after every credential rotation, privilege change, or new trust relationship.

These controls tend to break down in highly dynamic cloud and SaaS environments because relationships change faster than the graph can be refreshed.

Where Exposure Management Fails in Real Environments

Tighter exposure management often increases operational overhead, requiring organisations to balance better prioritisation against the cost of maintaining accurate context. The main tradeoff is that richer graphs need better identity telemetry, better asset-to-identity mapping, and cleaner data on secrets, permissions, and trust links. Without that, the programme slips back into dashboard mode. This is especially true in environments with heavy third-party OAuth use, where NHIMG’s The State of Non-Human Identity Security notes that 85% of organisations lack full visibility into connected vendors.

Current guidance suggests treating some edge cases as known uncertainty rather than forcing false precision. For example, ephemeral workloads, serverless functions, and AI-driven automation can create short-lived attack paths that vanish before periodic scans complete. In those cases, the most practical response is policy-driven prevention, stronger secrets hygiene, and continuous identity monitoring, not a perfect graph. The CISA cyber threat advisories and 52 NHI Breaches Analysis both reinforce the same pattern: attackers exploit the relationship between exposure and privilege, not isolated findings. Best practice is evolving, but the consistent failure mode is treating path analysis as a one-time review instead of an always-on remediation trigger.

Related resources from NHI Mgmt Group

• What do security teams get wrong about attack surface management?
• What do security teams get wrong about false positives in exposure management?
• What do security teams get wrong about exposure management in regulated sectors?
• What do security teams get wrong about asset exposure in vulnerability management?