Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Are Using Attack Path Management
Transcript
- Lucas: So there's this stat that's been bouncing around my head since I read the latest Verizon data breach report. Seventy-four percent of the breaches they analyzed involved a known, unpatched vulnerability. Not a zero-day. Not some exotic exploit. A patch that existed and just didn't get applied. Luna: That's the part that gets me. It's not that attackers are geniuses. It's that we're leaving the door unlocked. Lucas: Exactly. And that's why I wanted to talk about attack path management today. Because it's a discipline that tries to answer a really specific question: if an attacker gets in through that unpatched vulnerability, what's the actual path they'd take to something that matters? And how do we break that path before they walk it? Luna: So it's not just about patching everything. It's about understanding how vulnerabilities chain together. Lucas: Right. Patch management in the traditional sense is about fixing individual weaknesses. Attack path management is about understanding the sequence of steps an attacker would take — the lateral movement, the privilege escalation, the hop from a low-value server to the domain controller. It's a map of the ways in. Luna: And I'm guessing most companies don't have that map. Lucas: Most have never drawn it. They have vulnerability scans that show thousands of CVEs, but they don't know which ones are actually exploitable in their environment, or which of those exploitable ones sit on a path to the crown jewels. So you end up with teams patching whatever's loudest, or whatever the vendor is pushing, when they should be asking: which of these vulnerabilities are actually on a route an attacker could take to the data we care about most? Luna: And that's where the graph comes in, right? Because you're modeling the network as nodes and edges. Lucas: Precisely. You model everything — users, groups, computers, applications, data stores. And you map the connections, the permissions, the trust relationships. Then you overlay known vulnerabilities and exploit techniques. What you get is a graph of possible attack paths. And suddenly you can see things like: a help desk account that has local admin on a server that's part of a cluster that can access the finance database. Luna: That's terrifyingly specific. Lucas: It is. But it's also the point. Because once you see that path, you can break it. You can remove that permission, you can segment the network, you can prioritize that patch over the one in the marketing department's CMS that nobody ever touches. Luna: So it's about focusing effort. In a world where you can't patch everything, you at least patch the things that are on a path. Lucas: And that's the shift that's been happening. I've been talking to CISOs who are moving from a compliance-driven, patch-everything mindset to a path-driven, prioritize the critical mindset. They're using tools that continuously map these attack paths, and they're feeding that into their vulnerability management process. Luna: Can you give me a concrete example of that in action? Lucas: So there was a mid-sized healthcare company I read about — I won't name them, but they had about eight thousand employees. They ran a typical Active Directory setup, a mix of on-prem and cloud. They were drowning in vulnerabilities — their scanner reported over ninety thousand. But when they did an attack path analysis, they found that only about three percent of those were actually exploitable in their environment. And of those, only a handful were on a path to their crown jewels — which, for a healthcare company, is patient data, obviously. Luna: So ninety thousand down to maybe two hundred that really matter. Lucas: Something like that. And they were able to fix those in a matter of weeks, not years. They also found a chokepoint — a single server that was on every path to the data. By segmenting that server, they cut their overall exposure by half. That's the kind of result that gets a CISO a seat at the table. Luna: It's almost like defense in depth, but with a map. Lucas: That's a good way to put it. Defense in depth without a map is just hope. You're layering controls, but you don't know if they're actually covering the routes an attacker would take. Attack path management gives you that visibility. Luna: So what's the pushback? I imagine some security teams would say, 'We don't have the data to build this graph.' Lucas: That's a fair point, and it's one of the key challenges. You need good asset inventory, identity data, and network flow data. If your CMDB is a mess — and whose isn't — you're going to have gaps. But the tools are getting better at ingesting this stuff automatically, and you can start small. You don't need to map the entire enterprise on day one. You can start with your crown jewels and work backward. Luna: Start with the data you absolutely cannot lose, and trace back. Lucas: Exactly. And that's what I hear from CISOs who are doing this well. They'll bring in a tool, but they'll also do a manual exercise first — a kind of red team exercise where they trace likely attack paths on a whiteboard. It's amazing how much you learn from that, even before you get fancy software. Luna: And the software — is it a separate category now? Or is this getting folded into existing tools? Lucas: It's emerging as its own category, but it's also being integrated into vulnerability management platforms and identity security tools. There are dedicated attack path management vendors, but you're also seeing features in broader platforms. The challenge is that it's a complex problem — you need graph databases, you need to understand Active Directory, you need to model cloud permissions. So the dedicated tools tend to be stronger on the analytics. Luna: And the analytics — what does that output actually look like? For a CISO who's used to a dashboard of red and yellow dots. Lucas: The output is a graph that shows you the paths, color-coded by risk. But more importantly, it gives you a prioritized list of actions. It tells you: if you change this permission, you break these five paths. If you patch this server, you break this one. It's prescriptive, not just descriptive. Luna: So it moves from 'here's what's vulnerable' to 'here's what to do about it.' Lucas: And that's a huge shift. It's also a shift in mindset for the security team. Instead of chasing CVEs by severity score, you're thinking about business impact. And that's a language that the board understands. Luna: Right, because you can say 'our patient data is exposed through these three paths' rather than 'we have 10,000 high-severity vulnerabilities.' Lucas: Exactly. And I've seen CISOs use this to justify budget. They can say, 'We need to invest in identity hygiene because it breaks seventy percent of our attack paths.' That's a much stronger argument than 'we need a new tool.' Luna: And it's not just about the initial map. This has to be continuous, right? Because networks change. Lucas: Absolutely. If you do this as a one-time project, it's just a snapshot. The whole point is to make it part of your ongoing operations. New assets come online, permissions get granted, vulnerabilities get discovered. You need to be re-evaluating the paths on an ongoing basis. Some of the tools do this automatically — they're constantly ingesting data and updating the graph. Luna: It sounds like there's a risk of alert fatigue here too. If the tool is constantly finding new paths, how do you prioritize? Lucas: That's a real concern. The answer is to focus on the paths that lead to your crown jewels. You define what those are — the data, the systems, the accounts that would cause catastrophic damage if compromised. Then you prioritize the paths that reach them. A path to a low-value server is still a concern, but it's not your top priority. Luna: And that's where the human judgment comes in. The tool can show you the map, but you have to decide what you're protecting and how much risk you're willing to accept. Lucas: Right. And that's why I think this is such an interesting space. It's not just about technology. It's about how you think about risk and how you communicate it. Luna: I love that. And before we get too deep into the tech, I want to say — if this conversation is giving you a framework for how you think about your own security posture, that's exactly what we're going for here. And if you're finding value in these episodes, the way they stay ad-free is listener support. You can buy me a coffee at buy me a coffee dot com slash fexingo. It keeps the lights on and helps us keep doing these deep dives. Lucas: Yeah, honestly, every little bit helps. And it lets us keep bringing you the kind of conversations that operators can actually use. Luna: So back to the practical side — if someone wants to start with attack path management, what's the first step? Lucas: I'd say start with your crown jewels. Write down the five to ten things that would put you out of business if they were compromised. Then trace backward: what accounts can access them? What servers can access those accounts? You'll be surprised how quickly you find a chain that you didn't know existed. Luna: And that's something you can do this week, without buying any software. Lucas: Exactly. And once you have that map, you can start making decisions. You can see where the chokepoints are, and you can start breaking the chains that matter most. That's the core of attack path management. Luna: It's a mindset shift, but it seems like a really practical one. Lucas: And it's one that's already paying off for the companies that are doing it. I think we're going to see this become a core part of how security teams operate over the next few years. Luna: It's one of those ideas that seems obvious in hindsight. You can't defend what you can't see.