Attack Paths

An attack path is a chain SubImage reconstructs from your graph showing how an attacker could move from an entry point to something that matters: an admin role, a database, a secret. Each step is a real capability an attacker would gain (network access, code execution, identity assumption, administrative control) traced across your cloud, identity, and code resources. Instead of a flat list of misconfigurations, you see how they combine into a route.

Paths are discovered automatically each time your data is refreshed. A path can come from the routine discovery pass, from a specific finding, or from a what-if scenario you create yourself.

The Attack Paths page

Open Attack Paths to see every discovered path.

At the top, the Security Score card summarizes your exposure on a 0 to 100 scale (higher is better; 100 means no discovered risk). It is computed from the number of paths and how critical each one is. Expand its History graph to see the score over Week, Month, or All time and watch it move as you remediate.

Each path in the list shows:

• Name and a one-line description of what it reaches.
• Criticality and Confidence bars. Criticality combines how damaging the path is with how easy it is to walk. Confidence reflects how sure SubImage is about the underlying data.
• Factors: the attack techniques the path uses, shown as icon chips.
• Where it came from: scanner (the default discovery pass), finding (a detection rule produced it), or scenario (a what-if you created), plus when it was first and last seen.

Sort by Criticality (the default), Last Seen, First Seen, Confidence, or Resources. Filter by Factors or search by name. Work top-down: a critical, high-confidence path reaching a crown-jewel asset is where to start.

Reading a path

Click a path to open it. The Overview tab lays the chain out as a timeline.

• Scores: the Criticality and Confidence bars again, in full.
• Summary: a plain-language explanation of the path, when available.
• Factors: the techniques in play.
• Steps: each step names the resource involved and the capability the attacker gains there, with a short description of how. A step marked critical is called out visually. Read top to bottom: the first step is the entry point, the last is the impact.

The capabilities you will see across steps:

Entry points are typically internet-exposed resources (for example an internet-facing EC2 instance) that need no prior access. The end of a path is usually a critical asset: a database, a secret, or a high-privilege identity your deployment treats as high value.

The Resources tab shows the same path as a node graph, with arrows in the direction the attacker moves. Click any node to inspect its properties. The Visualize button on the Overview tab opens the full graph explorer around the path in a new tab.

What-if scenarios

Scenarios let you model a compromise that has not happened yet. You tell the engine to assume certain nodes have a capability already, and SubImage recalculates paths as if that were true, so you can see the blast radius of "what if this laptop, this CI runner, or this service account were compromised".

This is useful during incident response. If your SIEM flags a suspicious sign-in on a user account, or your EDR raises an alert on a device, model that node as compromised and let SubImage show everything newly reachable from it. You can build a scenario by hand here, or drive the same thing over MCP to enrich a SIEM or EDR alert with its blast radius as part of an automated IR workflow.

From the Attack Paths page, click Scenarios, then New:

1. Pick a Node Label (for example EC2Instance or GitHubUser).
2. Pick a Capability to grant (the list explains each one).
3. Optionally add Filters (node property key/value pairs) to narrow which nodes it applies to, and a description.
4. Click Add Capability.

New paths are calculated automatically. Scenario-derived paths are labeled as such in the list and do not count toward your Security Score, so modeling never distorts your real posture. Remove a capability from the Capabilities tab to drop the scenario.

Creating and deleting scenarios requires the Operator role or above.

How attack paths relate to the rest of SubImage

Attack paths are one of the raw signals behind Issues: a path that runs through an affected resource shows up as a supporting signal on the relevant issue, which is how path context feeds prioritization. A path can also raise the criticality of a finding: if a rule's result sits on a critical step, that step elevates the finding's priority.

Programmatic access

The same paths are available over MCP, so an agent can enumerate and walk them alongside you: subimageListAttackPaths, subimageGetAttackPathDetails, subimageGetAttackPathsFromAsset, and subimageGetScenarioCapabilities. For a guided walkthrough, the subimage-mcp:review-attack-path skill steps through a path, hunts for credible extensions, and proposes the fastest fix. See Connect via MCP and Agent Skills.