Documentation Attack Path Engine

Attack Path Engine

The Attack Path Engine enables security teams to move beyond isolated vulnerabilities and understand how an attacker can chain minor misconfigurations to achieve total environment compromise.

How It Works

VerityLayer automatically constructs a directed graph of your network by overlaying:
  • Cloud Asset Inventory (e.g. EC2 instances, RDS databases, Lambdas)
  • Network topology and firewall rules
  • Identity and Access Management (IAM) entitlements
  • Existing open vulnerabilities, matched from the Vulnerability Queue

    • Blast Radius Calculation

    When an asset is compromised, how far can the attacker move laterally? The Attack Path engine calculates the Blast Radius by following outbound network rules and IAM assumption capabilities. If a vulnerable public-facing web server has an overly permissive Instance Profile that can decrypt KMS keys used by your database, VerityLayer highlights this specific Toxic Combination.

    Using the Visualizer

    Navigate to Cloud Security > Attack Paths: * The canvas provides a node-based physical representation of your infrastructure. * Red Nodes indicate compromised entry points. * Flashing Pathways indicate valid traversal paths an attacker could take based on permissions. * Click any node to see its associated CVEs and remediation recommendations.