Attack paths and reach. How single access steps add up to a route into production.
No single permission on this page is a vulnerability. The risk is in how the steps connect, and in which of them you can change without breaking the work that depends on it.
Questions, answered.
The basics, in two answers.
What is an attack path?
An attack path is a chain of access steps leading from an entry point to a valuable target such as production systems or sensitive data. Each step can be entirely legitimate on its own, which is why reviewing permissions one at a time does not find it.
How do you break an attack path?
Remove or narrow one step in the chain. The best choice is the breakpoint: the single change that closes the path while stopping the fewest legitimate workflows, which is usually scoping a role rather than rotating a widely shared key.
Other Academy categories.
The same picture from a different starting point.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.