Attack Path
A chain of individually legitimate permissions and relationships that together let a low-privileged identity reach a high-privileged one. Each link is a valid configuration; the risk is in the composition, which is why permission-by-permission auditing does not find it.
Attack path analysis treats the environment as a graph of principals, permissions, and relationships, then asks for the shortest route from any starting point to a target such as domain admin or a production role. Defenders historically reviewed group membership one object at a time while attackers read the whole graph, and closing a single well-chosen edge often removes thousands of paths at once. The approach originated in Active Directory tooling and now applies to cloud entitlements too.
See also: privilege escalation, lateral movement, Andy Robbins, CIEM, best ITDR tools
Related on Start with Identity
- GlossaryITDR
Identity Threat Detection and Response. Security tooling that detects and responds to identity-based attacks such as account takeover, privilege escalation, and
- GlossaryUEBA
User and Entity Behavior Analytics. Machine-learning analysis of normal behavior to flag anomalies that signal compromise or insider risk. A common building blo
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- ReportIdentity Breach Report 2026: how attackers get in
123 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 41 with a known MFA status, and 44% of 2025-2026 cases had no login for MFA to protect.
- BlogOkta buys Permiso Security to put ITDR inside the identity provider
Okta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of
- PodcastSemperis
Semperis' biweekly show for defenders of hybrid Active Directory and Entra ID environments, hosted by 15-time Microsoft MVP Sean Deuby.