Attack path discovery

Expanded Definition

attack path discovery is the analytical process of rebuilding an intrusion chain from scattered evidence so defenders can see how one action enabled the next. It goes beyond single alerts or isolated indicators and instead correlates logs, endpoint telemetry, identity events, cloud activity, and network traces to form a defensible narrative of compromise.

In practice, the term sits close to incident reconstruction, attack path analysis, and threat hunting, but it is more specific because it focuses on the sequence of attacker movement rather than just the presence of malicious activity. Security teams often map findings to the MITRE ATT&CK Enterprise Matrix to describe techniques such as initial access, privilege escalation, credential dumping, and lateral movement. NIST does not define the phrase as a standalone control term, but related logging, monitoring, and incident response expectations appear in NIST SP 800-53 Rev 5 Security and Privacy Controls.

Usage is still evolving in some tools and reports, so definitions vary across vendors: some use it to mean graph-based attack path modeling, while others use it for post-incident forensic reconstruction. The most common misapplication is treating a partial alert timeline as a complete attack path, which occurs when analysts fail to connect identity, cloud, and endpoint evidence into one validated sequence.

Examples and Use Cases

Implementing attack path discovery rigorously often introduces correlation complexity, requiring organisations to weigh faster conclusions against the cost of unifying telemetry and validating evidence.

• During incident response, analysts reconstruct how phishing led to credential theft, then to mailbox access, then to cloud privilege abuse, using identity logs and endpoint detections.
• In cloud investigations, teams trace how an exposed secret or misconfigured role allowed an adversary to pivot from one workload to another, then confirm the path with control-plane logs.
• In NHI-heavy environments, defenders identify how a compromised service account or API token enabled unauthorized tool execution, then map the movement across automation systems and APIs.
• Threat hunters compare the observed sequence against MITRE ATT&CK Enterprise Matrix or, for AI-enabled misuse, the MITRE ATLAS adversarial AI threat matrix to describe the attacker’s tactics consistently.
• After public advisories, security teams use CISA cyber threat advisories to test whether their own telemetry supports the same attack chain described in the warning.

Attack path discovery is especially useful when the same actor blends identity compromise, cloud abuse, and automation misuse, because no single product view usually shows the whole sequence.

Why It Matters for Security Teams

Security teams rely on attack path discovery to decide what actually happened, what was reachable, and what needs containment first. Without it, response can over-focus on the last alert while missing the earlier control failure that made the intrusion possible. That creates weak remediation, repeated compromise, and poor executive reporting.

This matters directly for identity security because many modern intrusions move through accounts, privileges, and non-human credentials rather than through malware alone. If an adversary steals an API key, abuses a service principal, or escalates through over-permissioned access, the attack path often reveals the real control gap more clearly than the final impact event. The reconstruction also supports evidence-based hardening against recurring abuse patterns documented in Anthropic's first AI-orchestrated cyber espionage campaign report.

Organisations typically encounter the cost of weak attack path discovery only after a breach review reveals that critical telemetry existed but was never correlated, at which point reconstruction becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Attack Surface Management
• How should organisations respond when trusted access becomes the attack path?
• What breaks when attack path analysis is not used for AI workloads?
• How should security teams prioritise vulnerabilities when AI speeds up attack discovery?