Overview
Real attackers rarely rely on a single flaw. They string weaknesses together into an attack path — a chain of steps from initial access to their goal. Thinking in paths, not isolated bugs, is what separates mature security from checklist security.
Learning objectives
- Define an attack path and attack chain.
- Understand how minor issues combine into serious compromise.
- Use the "break the chain" idea to prioritize defenses.
Core concept
An attack path is the route an attacker takes through a system: each step exploits a vulnerability or misconfiguration and enables the next. A single low-severity issue may be harmless alone but decisive as one link in a chain. This is why attackers value chaining: three "medium" problems can combine into a full "critical" compromise.
A widely taught model of the stages is the Cyber Kill Chain (Lockheed Martin): reconnaissance → weaponization → delivery → exploitation → installation → command and control → actions on objectives. MITRE ATT&CK describes the same journey as a matrix of tactics and techniques.
How it works
Because every path is a sequence, defenders do not need to block every step — breaking any single link stops the whole chain. This reframes defense: instead of trying to fix everything, find where a chain can be cut most cheaply. It also explains defense in depth — multiple layers give multiple chances to break the path.
Practical example
Consider this chain against an internal app:
- An attacker finds an employee's password in a public data leak (initial access).
- The app has no MFA, so the password works (weak control).
- A low-privilege account can read a config file containing a database credential (information disclosure).
- That credential grants admin on the database (privilege escalation).
- The attacker exfiltrates customer data (objective).
No single step is exotic, yet together they are a breach. Adding MFA at step 2, or removing the credential at step 3, breaks the chain.
Cybersecurity relevance
Penetration testers and red teams think entirely in attack paths — their reports show the chain, not just a list of bugs. Defenders use the same lens to decide which fix delivers the most protection for the least effort.
Common mistakes
- Judging vulnerabilities only in isolation, missing dangerous combinations.
- Trying to fix everything at once instead of finding the cheapest link to cut.
Key takeaways
- An attack path is a chain of steps from access to objective; minor issues combine into major ones.
- Breaking any single link disrupts the whole path.
- Prioritize the fix that most cheaply cuts the most dangerous chains.
Check your understanding
- In the example chain, which single control would you add first, and why?
- Explain how three "medium" issues could add up to a "critical" outcome.