Attack Path
A chain of individually legitimate permissions and relationships that together let a low-privileged identity reach a high-privileged one. Each link is a valid configuration; the risk is in the composition, which is why permission-by-permission auditing does not find it.
Attack path analysis treats the environment as a graph of principals, permissions, and relationships, then asks for the shortest route from any starting point to a target such as domain admin or a production role. Defenders historically reviewed group membership one object at a time while attackers read the whole graph, and closing a single well-chosen edge often removes thousands of paths at once. The approach originated in Active Directory tooling and now applies to cloud entitlements too.
See also: privilege escalation, lateral movement, Andy Robbins, CIEM, best ITDR tools
Related on Start with Identity
- GlossaryITDR
Identity Threat Detection and Response. Security tooling that detects and responds to identity-based attacks such as account takeover, privilege escalation, and
- GlossaryUEBA
User and Entity Behavior Analytics. Machine-learning analysis of normal behavior to flag anomalies that signal compromise or insider risk. A common building blo
- GlossaryAccount Takeover (ATO)
When an attacker gains control of a legitimate account, often via stolen credentials, phishing, or session theft. A leading cause of breaches and fraud. The dis
- BlogOkta buys Permiso Security to put ITDR inside the identity provider
Okta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of
- BlogSilverfort acquires Fabrix Security, a one-year-old AI access-decision engine
Price undisclosed, reported as tens of millions for a company founded in 2025. Fabrix supplies the identity knowledge graph and decisioning; Silverfort supplies
- GuideIdentity Threat Detection and Response (ITDR) Guide
A complete guide to implementing Identity Threat Detection and Response, covering detection rules for identity-based attacks, lateral movement detection, respon