Attack path
An attack path is a sequence of actions and conditions through which an attacker could move from a starting position to a security-relevant objective, such as unauthorized access to sensitive data.
How one step enables the next
An attack path connects a starting position to an objective through specific actions and conditions. Microsoft Defender for Cloud, for example, models routes from external entry points through access relationships to critical assets. Other reviews may start with an assumed internal account or a human approval process.
An attack surface lists places an attacker could interact with. A path explains the connections between them. Several unrelated weaknesses do not become a path just because they appear in the same report.
Following a recovery request through to access
Mandiant’s 2024 UNC3944 reporting describes help-desk social engineering and MFA resets in intrusions involving SaaS applications. A recovery path worth examining might connect employee impersonation, a reset, enrollment of a replacement authenticator, and access to an application.
Each transition depends on something: the desk accepting the request, enrollment policy allowing the replacement, and the resulting session having the necessary permissions. A reset alone does not establish the whole route.
Mark which connections were observed, modeled, blocked, or left untested. This keeps a plausible route from being mistaken for a demonstrated compromise. It also makes remediation specific: the team can identify the verification rule or access relationship that needs to change.