Cloud attack path

In the cloud, access is granted through identity, and identities are connected: a role can assume another role, an instance carries a role, a service account can read a secret that unlocks a third identity. A cloud attack path is the walk across that graph from where an attacker lands to what they are after. Each edge is a single, often reasonable-looking permission; the danger is in the composition. The same idea as an on-premises attack path, applied to cloud entitlements: the value is not any one node but the route that connects a low-privilege foothold to a high-privilege outcome, which only appears when the graph is analysed as a whole.

The failure is reviewing cloud security as a list of independent findings, which is what most tooling produces. Each item is triaged in isolation, marked low or medium, and the escalation that runs through three of them is never seen, because no single alert is high. From the attacker’s seat this is the whole method: chain a modest foothold to a role assumption, to a readable secret, to the data. A privilege escalation in the cloud rarely looks like an exploit; it looks like using entitlements that were each granted deliberately. The organisation that cannot see the path cannot prioritise, so it fixes noise and leaves the route open.

We deliver the result as attack paths, not a flat list. Each path is the sequence of identities and permissions from foothold to objective, with the reachable outcome demonstrated, so the client can cut the chain at its cheapest link rather than chase every finding. Entitlement analysis (CIEM) informs the graph, and cross-cutting relationships such as cross-account trust and metadata-exposed credentials are traced through it. This is how we present a cloud assessment as attack paths, which is what a posture scan cannot do.