Attack Graph Overview

Conceptual overview of attack graph materialization, path analysis, and how graphs support prioritization without implementation detail.

Analyst · Intermediate · Overview · 4 min read · Last updated: Jul 13, 2026 · Version 1.0

Attack Graph Overview

Industry Problem

Security teams see thousands of vulnerabilities and alerts but struggle to answer structural questions: If this entry point is compromised, what can be reached? Which identity or asset connects two critical systems? Is this finding part of a plausible attack chain?

Point-in-time severity scores alone do not expose relationship context—how exposures, identities, applications, and threat indicators connect across the environment.

Why the Problem Exists

Security data arrives from siloed tools with incompatible relationship models. Manual graphing in spreadsheets or generic diagramming tools does not scale, lacks provenance, and falls out of date after the next scan cycle.

Attack path analysis emerged to model feasible movement through an environment using assets, identities, network reachability, vulnerabilities, and controls—but products vary widely in whether they show pretty graphs or actionable, explainable prioritization.

Traditional Approaches

Approach Limitation
CVSS-only prioritization Ignores reachability and business context
Manual attack trees Not maintained at scale
Generic graph visualization Often lacks tenant governance and evidence linkage
Penetration test reports Point-in-time; not continuous
Threat intel feeds alone Indicators without environmental placement

Effective programs combine deterministic relationship analysis with analyst-led investigation—paths support decisions; they do not replace them.

SentriScope Perspective

SentriScope provides attack path intelligence as an investigation and prioritization capability (implemented). Public documentation uses attack graph language for familiarity; the product emphasis is paths, entities, and explainability—not unbounded graph exploration as an end in itself.

Design center questions the capability helps answer:

Question Role of attack path intelligence
Which entities matter most in this snapshot? Priority lists and high-risk entity context
What multi-hop chains exist between entities? Path traversal with confidence thresholds
What could be reached from a compromise? Blast radius and reachability summaries
Why is this path ranked highly? Explainability tied to canonical inputs
What should I investigate first? Feeds investigation workspace context—not autonomous closure

Important boundaries:

  • Attack path intelligence does not implement a second proprietary risk engine; deterministic risk scoring remains separate. See KID-PLT-0001.
  • Paths provide evidence for investigation within KID-INV-0001; this document does not define investigation methodology.
  • Threat intelligence correlation enriches context; traversal rules differ for certain intelligence edge types. Detail: KID-TIN-0001.
  • Longer-term scenario-centric prioritization themes are on the product roadmap—not all are generally available. Status: KID-PLT-0004.

Entity types referenced are canonical concepts—assets, identities, applications, exposures, vulnerabilities, incidents, and threat intelligence indicators—defined in KID-ARC-0001.

Current Product Capability

Capability State Summary
Snapshot-based relationship analysis Implemented Point-in-time view aligned with risk calculation cycles
Multi-hop path discovery Implemented Configurable confidence thresholds for traversable steps
Priority lists and high-risk entity context Implemented Supports operator triage entry points
Blast radius and reachability summaries Implemented Structural impact narrative for investigation
Path explainability Implemented Deterministic explanations over canonical inputs
Investigation UI integration Implemented Attack intelligence on key entity types during investigation
Read-only natural language query over paths Implemented Guardrailed assistance; not in scoring path
Scenario-centric primary queue Planned / progressive Longer-term prioritization evolution
Autonomous attack detection Not available Analyst interpretation required

Current Limitations

  • Analysis is snapshot-bound—results reflect materialization time, not live network state.
  • Path confidence and traversal rules produce hypotheses, not proof of exploitation.
  • Not every relationship type in the environment may be populated; connector coverage affects graph completeness. See KID-INT-0001.
  • Advanced scenario intelligence capabilities are planned or in progressive rollout; public documentation of scenario queues is incomplete.
  • This overview intentionally omits graph construction algorithms, internal edge taxonomies, and API contracts.

Common Questions

Is the attack graph a standalone visualization product?

No. It supports investigation and prioritization within SentriScope's intelligence and decision workflow—not generic graph drawing.

Does SentriScope prove attackers can traverse a path?

No. Paths are deterministic analyses over integrated data with stated confidence. Analysts validate relevance during investigation.

How does this relate to MITRE ATT&CK?

MITRE ATT&CK provides a technique framework; SentriScope correlates environmental relationships and canonical findings. Public technique mapping depth varies by deployment data.

Does attack path intelligence replace vulnerability scanning?

No. Scanners and assessments feed exposures; attack path intelligence contextualizes relationships among normalized findings.

Related Concepts

Prerequisites

See also

Planned (Stream B)

  • KID-CON-0002 Understanding Attack Paths
  • KID-GLS-0003 Attack path
  • KID-GLS-0004 Attack scenario

Related Articles

Tags Attack Graph · Attack Path · Intelligence

Related articles