Attack Path Analysis – Bitdefender TechZone

The circles on the graph, called nodes, represent the entities an attacker can compromise or transition through. Nodes are not limited to physical or virtual machines; a path can contain:

The arrows connecting nodes, called edges, are labeled with the specific mechanism an attacker would leverage to move from one step to the next. Selecting an edge opens a detailed description of the transition, including the associated CVEs and security findings that make the move possible. This relationship is what separates a connected path from a static list: every hop identifies the exact weakness enabling it.

Four risk factors appear as badges on paths and nodes, so you can see what makes each one dangerous:

Node outlines are color-coded by severity (yellow for low, orange for medium, red for high), and the final target asset displays an aggregated risk score ranging from 0 to 100.

On complex paths, the graph automatically collapses intermediate nodes into grouped segments labeled with the total node count. Grouping is strictly a visual optimization: grouped nodes retain their individual properties, locations, and telemetry, and can be expanded at any time to inspect individual hops.

The graph also keeps alternative routes to the target visible. Enabling the Shortest Path control highlights the most direct attack vector, while secondary branches remain visible to ensure you maintain visibility over redundant exposure routes.

Each path tracks its creation and last-updated timestamps, allowing you to distinguish newly emerged attack vectors from persistent exposure. Note that Attack Path Analysis models potential exposure calculated from scan and inventory telemetry, rather than live threat activity: it shows what an attacker could achieve, rather than active exploitation in progress.

Bitdefender GravityZone includes a pre-configured demo attack path that illustrates the structure of a live environment.

Fig. 2. The demo attack path in the Graph tab, with the Assets panel grouped by attack stage.

The path originates at the user account DEMO\Alice, flagged as the initial entry point due to heightened phishing risk. From there, it moves to the workstation DEMO-WS1, which exhibits an exploitable vulnerability alongside an endpoint misconfiguration. On that host, locally stored credentials provide the attacker with access to a secondary, higher-privileged account: DEMO\Bob.

From DEMO\Bob, the attack vector branches to three additional endpoints (DEMO-WS2, DEMO-WS3, and DEMO-WS4) - each containing vulnerabilities and misconfigurations that can be leveraged for lateral movement and privilege escalation - before culminating at the target asset, DEMO-WS5, which contains 28 High and Critical CVEs.

Fig. 3. The demo attack path: DEMO\Bob is the choke point between the entry account and the target.

DEMO\Bob functions as a strategic choke point: a critical node upon which multiple downstream exposure routes depend. Securing this single identity disrupts every secondary branch simultaneously—a outcome that patching downstream machines individually cannot match.

This illustrates the core value of attack path prioritization: while the highest-scoring individual findings sit on the end target, the remediation action with the widest systemic impact sits several hops upstream on a user identity.

Core Question: "Which routes exist, and which should I prioritize first?"

Overview: The central grid lists one path per row, displaying its name, risk factor tags, target asset, target risk score, asset type, platform, and last-updated timestamp.

Filtering & Views: You can filter the inventory by Risk Factors (e.g., isolating paths combining Public exposure with Exploitable CVE), Asset Risk Score, Platform, or Asset by Position (locating paths where a given asset serves as the Initial Asset, Target Asset, or an intermediate node). Paths requiring ongoing tracking can be saved to the Watchlist tab alongside the All Attack Paths view.

Detailed Path Inspection: Opening a path reveals two dedicated views:

Fig. 4. The Attack Path page, filtered by risk factor.

Core Question: "Is exposure improving or deteriorating over time?"

Key Widgets: New Attack Paths, Open Attack Paths Over Time (tracking net-new vs. resolved paths), Top 5 Attack Path Destinations, Top 5 Attack Path Entry Points.

Finding Choke Points: The Top 5 Entry Points widget serves as a rapid discovery tool for strategic choke points—instantly identifying single accounts or assets that initiate multiple distinct exposure routes.

Fig. 5. The Attack Path Analysis view of the ASM dashboard.

For Security Operations Center (SOC) analysts, an attack path represents a modeled hypothesis of how an intrusion could progress:

A modeled path ends at a file server marked as a critical asset, and the most prominent finding on it is a high-severity CVE. Standard triage protocols suggest patching the server first. However, checking the Top 5 Attack Path Entry Points on the ASM dashboard shows that a single user account initiates four separate attack paths. Opening any of those paths in the Graph tab reveals a recurring vector: heightened phishing exposure on the user identity leads to a workstation where locally stored credentials hand the attacker a second account with broader privileges.

Fixing that one account closes four attack routes, whereas patching the server closes only one. Selecting View Account directly from the node allows you to review its identity risks in User Risk Management and purge the cached credentials from the workstation. While the CVE on the file server still gets remediated through Patch Management, it is no longer the immediate blocker for the week.

Every finding along a path was already logged in Risk Management, but none appeared urgent in isolation because they were confined to internal machines. Filtering the Attack Path page by Risk Factors for Public Exposure together with Exploitable CVE reveals why those internal findings matter: an internet-facing service serves as the initial entry node, bridging directly into internal servers before reaching a high-value asset.

The Public Exposure Risks section on the entry node details what EASM discovered, and selecting View EASM Assets leads directly to the external infrastructure. Instead of trying to patch every downstream internal server at once, closing or restricting the exposed service removes the entry point that makes those downstream weaknesses reachable—achieving faster overall risk reduction.

After a month of remediation work, leadership asks whether the environment is genuinely safer or simply better patched. Adding the paths that end at mission-critical servers to the Watchlist allows you to track progress in Open Attack Paths Over Time on the ASM dashboard, which separates newly emerged paths from resolved ones.

A declining count of open paths provides clear evidence of risk reduction, showing that complete routes to key assets have been broken rather than just individual patch tickets closed. When a net-new route appears in New Attack Paths, the dashboard clarifies whether it represents an unmapped entry point or a new path to an existing target, giving you a clear starting point for the next planning cycle.

An attack path is a structural map of potential exposure, not an indicator of compromise. Attack Path models lateral movement based on scan telemetry and asset inventory rather than live runtime execution. A newly discovered path reflects a fresh combination of unpatched vulnerabilities or misconfigurations—not an active intrusion. If you suspect suspicious activity on an asset within a path, validate runtime behavior in Incidents and Search.

Nodes are not limited to endpoints. User identities are distinct nodes, as are derived resources such as an active SMB file-sharing service. In the interactive demo path, the remediation action with the widest impact targets an account identity rather than a host. Scanning the graph exclusively for servers and workstations causes analysts to overlook key identity choke points.

The Shortest Path control highlights the most direct vector to a target asset, but it is rarely the only route. Secondary branches remain visible on the graph because breaking a single hop on the shortest vector may leave the target vulnerable via alternative paths. Before applying a fix, verify whether the target node sits at an intersection common to all routes or merely on the shortest one.

Grouping intermediate nodes into collapsed segments is strictly a visual layout optimization for complex topologies. Grouped nodes do not necessarily share a network segment, physical location, or security policy, nor does the collapsed group carry an aggregate risk score of its own. Expanding the segment reveals individual hops alongside their specific risk factors.