Skip to main content
Attack paths turn a list of findings into a story the client understands: how an attacker would get in, how they would move, and what they would reach. Open a project, go to Project Data, then Graph, and switch from Attack surface to Attack paths. A small dot on the Graph tab marks it until you have opened it once. The view is live. It is rebuilt from the project’s current findings, hosts and services every time it opens, so a new internal finding, a fixed issue or a fresh beacon sweep changes the paths straight away.

How a path is built

A path reads left to right in four stages:
  1. Start: the internet, or an assumed foothold inside the network when the test is internal only.
  2. Way in: a medium or higher external finding that gives entry, such as an exposed VPN or remote access service, code execution, injection, SSRF, file read or leaked credentials.
  3. Move inside: an internal weakness that moves an attacker along, such as LLMNR or NBT-NS poisoning, SMB without signing, weak or default accounts, or an exploitable or unauthenticated service.
  4. Target: an internal host worth reaching, recognised from its open ports, names and products: a domain controller, a database, a file server, or a hypervisor or backup system.
The strongest paths are ranked by severity and target value. Hover a path to trace it through the graph; select it to see each step with the finding or host it rests on and why it leads to the next. Click a step to open the issue or the internal asset.
Paths are built by fixed rules from the project’s own findings, hosts and services, so the same data always gives the same paths. Unverified findings are marked, and fixed issues and false positives are left out. They are chains for the tester to prove or rule out, not proof that a compromise happened.

Where paths show up

  • The Graph tab: the four columns with each path drawn through them, the strongest paths listed below, and a detail panel for the one you select.
  • The State of security deck: the strongest path gets its own slide, so the client meeting starts from the route that matters most. See State of security deck.
  • Internal tests: when a project only has internal findings, paths start from an assumed foothold inside the network instead of the internet, so they still show how far an attacker could move. Internal findings come from the Black Hole Beacon.