Attack path mapping runs as the discipline of drawing the route an attacker would actually take through the environment, then fixing the parts of the route that are stupid. The discipline has been overcomplicated by the vendors (the XM Cyber, the AttackIQ, the SafeBreach all selling the platform that promises to automate the mapping) and underused by the practitioners (the small security team that knows the environment better than the vendor ever will). The honest version runs as the version that produces the fixes, not the version that produces the slide deck.
The honest framing matters here, because the attack path map that lands in the slide deck runs as the attack path map that nobody opens again. The attack path map that lands in the ticket queue runs as the attack path map that closes the gap.
What the map looks like
Three layers, in roughly that order of how much each one tells you. The first runs as the entry point layer, where the map shows the public facing systems, the exposed services, the phishing surface, the supply chain dependency, the entry point that the attacker uses to land inside. The entry point layer answers the question of where the attacker gets in. The second runs as the privilege layer, where the map shows the identity tier, the service account tier, the privileged account tier, the lateral movement path, the escalation path, the privilege layer that the attacker uses to move from the entry point to the crown jewel. The privilege layer answers the question of how the attacker moves once they are inside. The third runs as the data layer, where the map shows the crown jewel, the data store, the backup, the exfiltration target, the data layer that the attacker uses to monetize the breach. The data layer answers the question of what the attacker actually takes.
How to build one without a vendor
Three things the small security team can do without buying a platform. The first runs as the manual mapping exercise, where the team sits in a room with a whiteboard, the team draws the entry points, the privilege paths, the data stores, the team does the mapping once a quarter, the manual mapping exercise produces the map that the team actually understands. The second runs as the graph database query, where the team queries the existing graph (the Active Directory, the cloud IAM, the CMDB) for the paths from the external entry point to the crown jewel, the graph query produces the map that updates as the environment changes. The third runs as the adversary emulation, where the team runs the red team, the purple team, the breach and attack simulation, the emulation produces the map that reflects the actual attack, the emulation that the team runs quarterly produces the map that closes the gap. The three together serve as the attack path mapping that the small team can actually do.
How the map produces fixes
Three ways to make the map actually do something. The first runs as the choke point identification, where the map shows the three or four nodes that every path passes through, the choke point that the defender can harden, the choke point that turns the path from a free walk to a forced climb. The choke point sits as the highest use fix the team can make. The second runs as the dependency removal, where the map shows the dependency that does not need to exist, the legacy service account that the new platform replaced, the network path that nobody remembers opening, the dependency that the team can remove without breaking the production system. The third runs as the detection gap exposure, where the map shows the step on the path that the detection stack does not cover, the alert that does not fire, the log that does not get retained, the gap that the detection engineering team can close. The team that identifies the choke point, removes the dependency, and closes the detection gap serves as the team that makes the map do something.
The bottom line
Attack path mapping in 2026 sits as the discipline the small team can do with a whiteboard and a quarterly cadence. The three layers, the three moves without a vendor, the three ways the map produces fixes. The team that does the three moves holds the line. The one that buys the platform and skips the mapping does not.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
