Attack paths
How SpectrAI links proven findings into attack paths, what the provenance of each step means, and why a path adds no assumption to the evidence.
Definition#
An attack path is a demonstrated chain of findings: each step relies on linked evidence, and the path shows how weaknesses taken separately combine. A pentest's page presents them in Proven attack paths; the report includes them.
How they are established#
The paths are derived from the findings and their evidence once the attempt is complete and consistent. They are a deterministic projection of the evidence: the same attempt always gives the same paths. They contain no assumed step.
Each step indicates:
- the finding it relies on and its linked evidence;
- the exact authorised target concerned;
- the attempt it comes from (the provenance).
Read a path#
A path reads from the starting point to the impact. A pentest may produce none: "No proven attack path" means that the published findings do not combine in a demonstrated way, not that a combination is impossible.
For each path, the report offers a map of the steps linked to the findings and their evidence.
Limits of attack paths#
- A path does not model theoretical threats: only proven steps appear.
- A path does not measure probability: it is not "more likely" than another.
- Attack paths do not guarantee exhaustiveness: other combinations may exist beyond what was demonstrated.