Attack Path Overview
Attackers usually do not target your most valuable asset right away. Instead, they find an easy entry point and then move through your system to get to other assets. Attack Path helps you see these routes, so you can fix the most important vulnerability and protect your critical assets.
Navigate to: Risk Management > Attack Path (Beta)
Use it to: See how findings on connected assets add up to real risk.
Best for: Security operations, vulnerability management, and cloud security teams.
Prerequisite
This feature is currently in Beta. To try it out, contact Qualys Support or your Technical Account Manager (TAM) to have it activated for your account.
What Is an Attack Path
An attack path is a chain of connected assets. It starts at an asset that an attacker can access, such as an internet-facing virtual machine, and ends at a high-value target, such as a storage bucket or database. Each step in the chain is possible because of a finding, such as a vulnerability or a misconfiguration, on the asset.
Here is what a simple attack path looks like:
| Step | Asset | Why the attacker can use it |
|---|---|---|
| Entry point | AWS EC2 instance | Internet-facing, with a weaponized vulnerability |
| Next step | AWS EC2 instance | Reachable from the first instance |
| Final target | AWS S3 storage | Holds business data |
Fix the right finding on any step, and the whole route to the storage bucket closes.
Why Attack Paths Matter
A single finding rarely tells you how much risk you actually carry. A medium-severity issue on an internet-facing virtual machine can matter more than a critical issue on an isolated asset, because it is the first step toward a business-critical target.
Attack Path brings together how your assets are connected, which assets are exposed, and which findings they have. It then shows you the routes an attacker can actually use, sorted by severity.
How Attack Paths Are Detected
Attack paths are detected by rules. The Qualys Threat Research team writes each rule using defined conditions on assets and findings. When the assets and findings in your account match a rule, ETM creates an attack path for each match. One rule can have many attack paths.
Attack paths can include both kinds of assets, based on the conditions in each rule:
| Asset type | Examples |
|---|---|
| Host assets | Virtual machines and cloud compute instances, for example, AWS EC2 instances. |
| Non-host assets | Storage, containers, and serverless functions, for example, AWS S3 storage and Azure functions. |
You see only the rules that have detected at least one attack path in your account. The rules you see reflect your environment, not the full set of rules.
Key Terms
| Term | Meaning |
|---|---|
| Attack path | A route an attacker could take through connected assets to reach a target asset. |
| Rule | A set of conditions on assets and findings, written by the Qualys Threat Research team, that detects attack paths. |
| Entry point | The first asset in an attack path, where an attacker could first get in. |
| Node | An asset in the attack path graph. |
| Edge | The arrow between two nodes. It shows one step of the attacker's movement. |
| Final target (impacted asset) | The last asset in an attack path. This is the asset the attacker could reach. |
| Crown Jewel | A business-critical asset. An asset is a Crown Jewel when it has the highest Asset Criticality Score (ACS), which is 5. |
| Contributing factors | The types of risk that meet the conditions of a rule, such as Credential Theft, Data Exfiltration, Lateral Movement Potential, and Remote Code Execution. |
| Severity | How serious the attack path or rule is: Critical, High, or Medium. |
Prerequisites
- Attack Path is available on request. Contact Qualys Support or your Technical Account Manager (TAM) to turn it on for your account.
- You must have the required permissions to view the Attack Path (Beta) tab.
What You Can Do in Attack Path
- Find attack paths: See every attack path in your account, and filter by severity, entry asset type, and impact area.
- Review rules: Learn why each attack path exists, and read the recommended mitigation.
- Investigate a path: Open the graph, and check the findings and MITRE ATT&CK details behind each step.
You can use attack paths to investigate and prioritize risk. You cannot start remediation actions from the attack path graph. To fix the findings, use the Findings tab.
Start with attack paths that are Critical and end at a Crown Jewel. These routes put your most important assets at the highest risk.