Guide

What is attack path analysis?

By the Alye team · Updated November 7, 2026

Short answer

Attack path analysis maps your cloud the way an attacker would: from what the internet can reach, through vulnerable software and over-permissive roles, to the data you care about. It turns hundreds of separate findings into a few routes, and shows the one change on each route that breaks it.

What an attack path is

An attack path is a chain of conditions that, together, let someone get from outside your cloud to something valuable inside it. A typical one on AWS:

An EC2 instance has a security group open to the internet on port 443.
It runs a web service with a known remote-code-execution CVE.
It still allows IMDSv1, so code running on it can fetch its role's credentials.
That role can read an S3 bucket tagged data-class=pii.

Each step on its own might be rated medium. Together they are a route to customer data.

How the analysis works

The tool builds a graph of your resources: what faces the internet, which workloads run where, which identity each one uses, and what each identity can read or change. Vulnerabilities and misconfigurations are attached to the nodes they affect. It then searches the graph for routes that start at the internet and end at a sensitive data store or an admin-level permission.

Fix the weakest link first

You don't have to fix every step on a path to close it; one is enough. The best choice is the step that is cheapest to change and sits on the most paths. In the example above, requiring IMDSv2 on the instance breaks the route without touching the application, and may close other paths that share the same instance.

Ranking fixes by how many paths they break gives a short list that actually reduces risk, instead of a long list sorted by severity.

Knowing where the sensitive data is

Paths only matter if they end somewhere that matters. Tagging data stores (for example data-class=pii, payments or secrets) tells the analysis where your sensitive data lives without anyone reading the data itself. Alye marks sensitive stores from those tags only; it never looks inside buckets or databases.

Checking the path is really closed

After a fix, the next scan rebuilds the graph. If the route no longer exists, the issue closes on its own; if someone reverts the change, it reopens. That is the difference between closing a ticket and removing the risk. For how findings are ranked in the first place, see what CSPM is and how to prioritize CVEs.

Questions

Is attack path analysis the same as penetration testing?

No. A penetration test has a person actively try to break in at one point in time. Attack path analysis reads your configuration every day and shows routes that could be used. It is continuous and doesn't touch your workloads, but it doesn't replace a pen test.

Does attack path analysis need write access to my cloud?

No. It needs only read access to configuration, roles and policies. Alye uses a read-only role and can't create, change or delete anything.

What counts as sensitive data in the analysis?

Whatever you mark. In Alye you set a tag rule, for example data-class=pii, payments, secrets, and every data store with a matching tag becomes a target the analysis looks for routes to.

See it on your own cloud. See the attack paths in your own AWS or Google Cloud account, with the fix that breaks each one.

Book a demo See Alye Security