# Attack Paths A single finding rarely tells the whole story. Attackers chain weaknesses together: a service account with a weak password leads to a privileged ticket, which leads to the whole domain. The **Attack paths** tab of the [Security Score](https://wiki.cyberguard.srl/cat/assessment/security-score.md) shows these chains, built from the open findings of your assessments, so you can see which fixes actually stop an attacker. You find it in **Security Score → Attack paths**. ## What You See The tab has one sub-tab per scenario: | Sub-tab | Where the paths start and where they lead | | --- | --- | | **Active Directory** | From any domain user to **Domain Admin**. | | **Microsoft Entra** | From a compromised identity to **Global Administrator**. | | **AD → Microsoft Entra** | From a compromised on-premises domain to **Global Administrator** in the cloud: synchronized administrators, the Seamless SSO key, federation with AD FS. Shown when you have both an Active Directory and a Microsoft Entra assessment. | | **Microsoft 365** | From a compromised identity to the organization's mail, files and conversations. | The paths are known attack techniques, each mapped to MITRE ATT&CK. A path appears as **open** only when the findings of your latest assessment make it possible. ## Reading a Path  On the left, **Paths** lists the open paths with their number of steps. Select one to draw it on the map: - **Start** — where the attacker begins (for example any domain user). - **Step** — a move made possible by a finding of your assessment, with the MITRE ATT&CK technique on the arrow and the number of objects to fix. - **Consequence** — what the attacker obtains with that move (for example a password cracked offline). - **Goal** — the target of the path (for example Domain Admin). Select a step on the map to open its **Details**: - the **finding** that opens the step and its severity; - the **MITRE ATT&CK** technique, linked to its description; - how many **paths** use this step: fixing a step used by several paths closes all of them; - **How to close this step**, the recommended fix; - **Objects that open this step** — the domain controllers, accounts, certificate templates, certification authorities, users or groups that make the step possible. The step, and every path that uses it, stays open until **all** these objects are fixed. Each object can be documented in the [Workspace](https://wiki.cyberguard.srl/cat/workspace.md). **Open the assessment** takes you to the assessment the finding comes from. ## The Complete Map  **Show all paths** draws every open path on one map. Steps shared by several paths stand out immediately: they are the best place to start, because one fix breaks many paths. **Selected path only** goes back to a single path. ## Simulating a Fix  Before changing anything in your environment, you can check what a fix would achieve. Tick the objects of a step, or use **Mark all as fixed**: the step turns green ("Closed in the simulation") and every path that goes through it is marked as **broken**. The simulation only affects what you see on the page: nothing is saved and nothing changes in your environment. Reload the page to start over. The real result arrives with the next assessment, after you have applied the fix. ## Accepted Risks If an administrator has [accepted the risk](https://wiki.cyberguard.srl/cat/assessment/security-score.md#accepting-a-risk) of a finding, its step does not disappear: an accepted risk is still a way in for an attacker. The step stays open and is marked as **Accepted risk**; its details show who accepted it, until when and why. ## Using Attack Paths to Prioritize 1. Open **Show all paths** and look for the steps shared by several paths. 2. Select those steps and read the objects to fix. 3. Simulate the fix to confirm it breaks the paths you expect. 4. Apply the fix in your environment and record it in the [Workspace](https://wiki.cyberguard.srl/cat/workspace.md). 5. Run a new assessment and check the result in [What changed](https://wiki.cyberguard.srl/cat/assessment/security-score/what-changed.md): the paths you closed are no longer open.