See exactly how attackersmove across identity,cloud, and endpoints.
Spakto's Attack Graph Core ingests your environment's identity relationships, cloud configurations, network reachability, and asset trust to compute real, multi-hop attacker traversal paths — continuously updated as your environment changes.
Attackers see paths, not vulnerabilities
Three individually medium-severity findings combine into a direct route to your crown jewels. Attack Graph Core finds these chains before adversaries do.
Graph build pipeline
Four sequential phases ingest, model, analyze, and compute — producing a continuously updated attack graph that reflects your live environment state.
Identity Mapping
Enumerate users, service accounts, roles, group memberships, trust relationships, and privilege chains across all identity providers.
Asset & Network Modeling
Map all assets, reachability between systems, network segmentation, VPC/VPN topology, and lateral movement potential.
Configuration Analysis
Ingest misconfigurations, over-permissioned roles, stale credentials, exposed services, and unpatched vulnerabilities.
Path Computation
Run graph traversal algorithms to compute all viable attacker paths, rank by exploitability and blast radius.
Five domains, one unified graph
Each domain is modeled as a typed subgraph with domain-specific edge semantics — all merged into a single traversal-ready adjacency structure at query time.
Identity & Privileges
Full enumeration of identity principals, privilege chains, and trust delegation — on-prem and cloud unified.
Cloud Infrastructure
Cloud-native IAM, resource relationships, cross-account trust, and data store exposure across AWS, Azure, GCP.
Network & Segmentation
Network reachability modeled as directed edges — every firewall rule, VPC peer, and routing path encoded in the graph.
Endpoint & Workload
EDR telemetry enriches the graph with process-level attack paths — memory injection, credential harvesting, and local privesc vectors.
External Attack Surface
Internet-facing exposure mapped as entry nodes — every exposed port, subdomain, and third-party access chain is a potential graph root.
Individual risks are noise. Combinations are attacks.
Traditional tools flag findings in isolation. Spakto chains them together — scoring the compound risk of combinations that individually score below your alert threshold.
Two MEDIUM findings + one credential file = direct path to production RDS and full account takeover. Combined chain score: 9.8 CRITICAL
Identity + Cloud
Over-permissioned IAM role assumed by compromised identity leads to cloud-wide privilege escalation.
Endpoint + Network
Compromised endpoint traverses poorly segmented network to reach sensitive systems via lateral movement.
External + Internal
Internet-facing misconfiguration provides direct path to internal crown jewels without authentication.
Cloud + Data
Cloud service misconfiguration enables mass data exfiltration through exposed storage layer.
Graph recalculates on every environment change
Every new asset, permission grant, cloud deployment, or identity change potentially creates new attack paths. Spakto re-evaluates the full graph within seconds — not hours.
New Cloud Resource Deployed
Ingest resource → compute new edges → re-rank paths through new node
Checks: inherits IAM profile? reachable from internet? connects to sensitive data?
Permission or Role Changed
Re-evaluate all paths using modified identity/role → diff new vs old path set
Detects: privilege escalation created? existing critical path widened? new assume-role chain?
New Vulnerability Discovered
Correlate CVE with asset graph position → score exploitability in existing chains
Critical only if: asset is on active path AND vuln is remotely exploitable AND no compensating control
Asset Decommissioned or Removed
Remove node from graph → identify broken paths → surface newly exposed paths
A pivot node removal may eliminate 10 paths but expose 2 previously blocked ones via rerouting
Who relies on the attack graph
Three operational roles query the graph differently — each receiving role-scoped path data, custom output formats, and targeted insights for their workflow.
Threat Hunting
Query the live graph to map what any compromised identity can reach — before attackers explore it.
Path maps · Blast radius report · Hunting playbook
Red Team Augmentation
Automatically surface attack chains that would take a red team days to discover manually — in minutes.
Attack scenario · T-code heatmap · Control bypass map
Incident Response
After a breach, trace backward through the graph to reconstruct the full attack chain and quantify blast radius.
Incident timeline · Affected assets · Remediation order
Every path carries a blast radius score
AGC scores each traversal path using a composite formula: score = criticality × reach × exploit × choke_factor. Only the paths that actually matter surface first — prioritized by true blast radius, not theoretical severity.
Crown jewel sensitivity rating (0–1.0)
% of env nodes reachable via this path
Composite CVSSv3 exploit score across hops
Path intersects 2 critical choke-points
| RANK | PATH ID | ENTRY → TARGET | HOPS | TECHNIQUES | SCORE | SEV |
|---|---|---|---|---|---|---|
| #1 | PSC-00041 | ext-user → prod-db | 5 | T1078·T1550·T1484 | 1,485.2 | CRITICAL |
| #2 | PSC-00019 | svc-acct → s3-crown | 3 | T1098·T1530 | 1,203.7 | CRITICAL |
| #3 | PSC-00088 | ec2-jump → ad-forest | 4 | T1021·T1558 | 987.4 | HIGH |
| #4 | PSC-00031 | vpn-user → rds-cluster | 6 | T1133·T1078·T1484 | 831.0 | HIGH |
| #5 | PSC-00055 | api-svc → kms-key | 2 | T1552·T1555 | 654.3 | HIGH |
Query the graph with AGC-QL
Purpose-built traversal query language for multi-hop attack path analysis. Express complex security questions as graph queries — return scored paths, technique chains, and blast radius data in milliseconds.
One attacker. Five domains. One path to your data.
Attack Graph Core maps multi-domain traversal paths end-to-end — from initial access through identity, network, cloud, and data tiers. Every hop is technique-tagged, evidence-backed, and scored.
Valid Account – domain credentials from credential stuffing campaign. No MFA enforced on VPN.
External Remote Services – domain user granted VPN access. Split-tunnel routes to internal EC2.
SSH lateral movement from VPN gateway to EC2 jump host. Shared SSH key pair grants access.
IAM role chaining via ec2-instance-profile. Privilege escalation through assume-role to admin.
Admin credentials grant full RDS access. Crown jewel reached in 5 hops from external entry point.
Attack Graph Core FAQs
Frequently asked
questions.
answered
An asset inventory shows what you have. A vulnerability list shows individual weaknesses. An attack graph shows how those weaknesses connect into paths an attacker can actually traverse to reach critical systems.
Continuously. Changes in identity, cloud configuration, network topology, or asset inventory trigger automatic graph re-evaluation within minutes.
Yes. Spakto models AD trust relationships, group memberships, Kerberos delegation, and LDAP exposure to map identity-based attack paths in on-premises and hybrid environments.
Yes. Spakto provides a query interface for attacker-centric questions — "which paths reach the crown jewels?", "what can this compromised identity access?", "which assets are reachable from the internet?"
Spakto models IAM roles, assume-role chains, resource policies, and cross-account trust relationships in AWS, Azure, and GCP — computing cloud-native privilege escalation and lateral movement paths.
A toxic combination is when multiple individually low-severity findings combine to create a critical attack path. For example, an over-permissioned service account (medium) + a misconfigured storage bucket (medium) = credential exposure that allows domain compromise (critical).
Paths are scored by: exploitability (how many attack techniques are required), blast radius (impact if path is traversed), asset criticality (value of the target), and attacker difficulty (skill/access required).