Deploy XM Cyber's continuous exposure management platform to map attack paths, identify choke points, and prioritize the 2% of exposures that threaten critical assets.
Instrucciones de origen · Vista previa de solo lectura
name
implementing-attack-path-analysis-with-xm-cyber
description
Deploy XM Cyber's continuous exposure management platform to map attack paths, identify choke points, and prioritize the 2% of exposures that threaten critical assets.
XM Cyber is a continuous exposure management platform that uses attack graph analysis to identify how adversaries can chain together exposures -- vulnerabilities, misconfigurations, identity risks, and credential weaknesses -- to reach critical business assets. According to XM Cyber's 2024 research analyzing over 40 million exposures across 11.5 million entities, organizations typically have around 15,000 exploitable exposures, but traditional CVEs account for less than 1% of total exposures. The platform identifies that only 2% of exposures reside on "choke points" of converging attack paths, enabling security teams to focus on fixes that eliminate the most risk with the least effort.
When to Use
When deploying or configuring implementing attack path analysis with xm cyber capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Detection Gaps & Validation
Undefined critical assets — paths without targets are meaningless. Validate that every Tier-1 asset is tagged before trusting choke-point output.
Identity blind spots — without AD read access, cached-credential and Kerberoast paths are missed. Validate the AD/Entra integration is connected and enumerating sessions.
On-prem ↔ cloud gaps — hybrid paths are missed if only one environment is onboarded. Validate cross-environment correlation by confirming a known trust relationship appears.
Stale model — one-time analysis misses paths created by new hosts/permission changes. Validate by re-running after infrastructure changes.
CVE tunnel vision — ~80% of exposures are misconfigurations; validate that identity/misconfig categories appear, not just CVEs.
Remediation not re-tested — validate a fixed choke point by re-running analysis and confirming the path is eliminated, not merely downgraded.
Prerequisites
XM Cyber platform license and tenant access
Network connectivity to monitored environments (on-premises, cloud, hybrid)
Administrative access for agent deployment or agentless integration
Cloud provider API access (AWS, Azure, GCP) for cloud attack path analysis
Active Directory read access for identity-based attack path modeling
CMDB or asset inventory defining critical business assets
Core Concepts
Attack Graph Analysis
Unlike point-in-time vulnerability scanning, XM Cyber continuously models all possible attack paths across the entire environment:
Traditional Scanning
XM Cyber Attack Path Analysis
Lists individual vulnerabilities
Maps chained attack paths
Scores by CVSS severity
Scores by reachability to critical assets
Point-in-time assessment
Continuous real-time modeling
No context of lateral movement
Models full lateral movement chains
Treats each vuln independently
Shows how vulns chain together
Key Metrics from XM Cyber Research (2024)
Finding
Statistic
Average exposures per organization
~15,000
CVE-based exposures
< 1% of total
Misconfiguration-based exposures
~80% of total
Exposures on critical choke points
2%
Orgs where attackers can pivot on-prem to cloud
70%
Cloud critical assets compromisable in 2 hops
93%
Critical asset exposures in cloud platforms
56%
Choke Point Concept
A choke point is a single entity (host, identity, credential, misconfiguration) that sits at the intersection of multiple attack paths leading to critical assets. Fixing a choke point eliminates many attack paths simultaneously, providing maximum risk reduction per remediation effort.
Attack Path 1: Web Server -> SQL Injection -> DB Admin Creds
\
Attack Path 2: VPN -> Stolen Creds -> File Server -> Domain Controller
/ (Critical Asset)
Attack Path 3: Workstation -> Mimikatz -> Cached Creds
^
CHOKE POINT
(Cached Domain Admin credential)
