# Attack paths

> How SpectrAI links proven findings into attack paths, what the provenance of each step means, and why a path adds no assumption to the evidence.

## Definition

An attack path is a demonstrated chain of findings: each step relies on linked evidence, and the path shows how weaknesses taken separately combine. A pentest's page presents them in **Proven attack paths**; the report includes them.

## How they are established

The paths are derived from the findings and their evidence once the attempt is complete and consistent. They are a deterministic projection of the evidence: the same attempt always gives the same paths. They contain no assumed step.

Each step indicates:

- the finding it relies on and its linked evidence;
- the exact authorised target concerned;
- the attempt it comes from (the **provenance**).

## Read a path

A path reads from the starting point to the impact. A pentest may produce none: "No proven attack path" means that the published findings do not combine in a demonstrated way, not that a combination is impossible.

For each path, the report offers a map of the steps linked to the findings and their evidence.

## Limits of attack paths

- A path does not model theoretical threats: only proven steps appear.
- A path does not measure probability: it is not "more likely" than another.
- Attack paths do not guarantee exhaustiveness: other combinations may exist beyond what was demonstrated.

---

https://docs.spectr-ai.eu/en/resultats/chemins-d-attaque