The sequence, not the point
An attack path is the sequence of steps taking an adversary from their initial position to the objective. Entering through an exposed service, obtaining a credential stored there, using that credential to reach a second system, and onward to the data or control that matters.
Three neighbouring words describe different things and get swapped constantly.
| term | what it describes |
|---|---|
| vector | the entry method, the first step |
| path | the whole sequence, from first step to objective |
| blast radius | the reach from a point, without ordering the steps |
Why thinking in paths changes priority
A queue sorted by severity treats each flaw as an isolated event. The adversary does not work that way: they chain.
That produces a counterintuitive effect. Three medium-severity flaws that chain are worth more to an attacker than one critical flaw leading nowhere. The sum of scores does not describe the threat, because the threat is the existence of the sequence.
The converse holds, and it is the useful part: breaking one link breaks the whole path. Often the cheapest link to break is not the most severe in the chain. Removing a credential from a config file can void a path that ran through three flaws which remain open.
Where paths usually run
A credential stored on a low-criticality asset is the most common link. It turns an unimportant server into the first rung of a ladder.
Shared identity across environments is the second. Staging authenticating against the production directory is production with another door.
Implicit trust between services is the third. Systems accepting each other because they share a network turn one compromise into several.
The limit of the analysis
Mapping paths requires knowing what exists and how things connect. The first half is discovery; the second depends on internal visibility that external observation does not provide.
From outside you can see the beginning of the path, which is the reachable part, and estimate the rest from what the asset holds and who it talks to. The complete path, with every internal hop, is work for someone with access to the environment.
This is why the honest reading combines both: exploitability validation to know the first step works, and blast radius to estimate how far it leads.