Betweenness centrality measures how often a node sits on the shortest path between other nodes in a graph. In security analysis, it helps identify techniques or assets that connect multiple attacker stages and are therefore high-value disruption points.
What Betweenness Centrality Tells You
Betweenness centrality is a graph metric that shows which nodes act as bridges between other nodes. In security analysis, those bridges matter because they can connect separate attacker steps, operational dependencies, or trust relationships, making them disproportionately important to monitor, disrupt, or harden.
The measure is directional in a practical sense even when the graph is not: a node with high betweenness may not be the biggest or most connected node, but it can still sit on the critical paths that many others rely on. That makes it useful for finding choke points, transit points, and hidden dependencies that are easy to miss if you only look at degree or volume.
Why It Matters in Security Analysis
Security teams use betweenness centrality to identify nodes that can amplify either attacker movement or defender intervention. A path-centric view helps reveal where compromise can cascade across stages, where one asset can bridge isolated zones, and where a single control failure could unlock multiple downstream outcomes.
It is especially useful when the graph represents infrastructure, identities, applications, data flows, or attack paths. In those settings, a node with high betweenness often deserves scrutiny because its removal, restriction, or monitoring can have outsized security value compared with a node that is merely popular or well-connected.
For the surrounding control context, NIST guidance on identity, access, and monitoring is often the operational backdrop for this kind of analysis, especially when the bridge node represents an account, token, service, or trust boundary. See NIST SP 800-53 Rev 5 Security and Privacy Controls for control families that support access restriction, auditability, and system integrity.
How It Differs from Other Centrality Measures
Betweenness centrality is not the same as degree centrality or closeness centrality. Degree tells you how many direct links a node has, while closeness focuses on how near a node is to all others. Betweenness instead emphasizes mediation, which is why it is better for spotting bottlenecks and connector nodes than for ranking simple popularity.
That distinction matters in cyber graphs. A low-degree node can still be a critical bridge if it sits between two otherwise disconnected clusters, while a high-degree node may be broadly connected but not lie on many shortest paths. The security significance comes from position in the path structure, not from raw connectivity alone.
Using Betweenness Centrality in Security Workflows
Analysts commonly use this metric to prioritise hardening, segmentation, detection, or disruption around the most strategic bridge points. It can support attack-path analysis, resilience planning, and control placement by showing where a modest change can have broad effects across the graph.
It also pairs well with other evidence. A node with high betweenness and suspicious activity, sensitive privileges, or broad cross-zone reach is more concerning than a bridge node in isolation. For identity- and privilege-heavy environments, this kind of prioritisation can help distinguish ordinary connectivity from paths that materially increase compromise impact.
Risk and Threat Considerations
Nodes with high betweenness can become single points of failure or single points of compromise. If an attacker gains control of a bridge node, they may be able to move between clusters, reach otherwise separated assets, or pivot through a route that defenders assumed was segmented.
Failure mechanism: The risk emerges when shortest-path traffic, trust relationships, or administrative workflows depend heavily on one intermediary node, so compromise or downtime at that point affects many paths at once.
Impact: The result can be broader lateral movement, reduced containment, degraded resilience, and an increased chance that one exposed asset creates multiple downstream security consequences.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Bridge nodes are often high-value monitoring points that benefit from audit analysis. |
| AC-4 — Information Flow Enforcement | Betweenness highlights paths where enforcing flow restrictions materially reduces traversal risk. | |
| Recommendation — Review activity around high-betweenness nodes to detect suspicious path traversal and abnormal pivoting. Apply flow controls to constrain traffic through high-centrality connector nodes. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Graph analysis depends on knowing the assets and nodes that exist in the environment. |
| GV.SC-01 — Cyber supply chain risk management strategy | Connector nodes can represent dependency concentration that affects resilience and trust boundaries. | |
| Recommendation — Inventory the systems and connections that feed centrality analysis so critical bridge points are visible. Assess dependency concentration at graph bridge points and reduce concentration risk where feasible. | ||
| MITRE ATT&CK | T1090 — Proxy | High-betweenness nodes often function as intermediate relays or pivot points in attack paths. |
| Recommendation — Map intermediary relay nodes to pivoting behaviour and hunt for abuse of transit paths. | ||
Practitioner Guidance
What to watch for: Treat high-betweenness nodes as candidates for deeper review, not automatic findings. Verify whether the node is truly acting as a bridge in the security-relevant graph, then compare that role with actual privilege, trust, and monitoring coverage before deciding how aggressively to segment or monitor it.
Governance implication: Ownership matters because bridge nodes often cut across teams and domains. If no one is accountable for the underlying path dependency, the organisation can end up with a high-impact connector that is technically visible but operationally unmanaged.
Practitioner takeaway: Use betweenness centrality as a prioritisation lens, then validate the graph result against the real environment before treating a node as a critical control point.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org