Why we model attacks as chains

This is a sample post. Replace it or set draft: true in the frontmatter to hide it.

Most security reports list findings one at a time, each with its own severity. That is useful for tracking work, but it hides the question leadership actually cares about, which is whether someone could get from the outside to the thing that matters most.

Thinking in paths

An attack chain lays the steps out in order: how an attacker gets in, how they establish a foothold, how they move toward something valuable, and what they do once they reach it. Seen that way, a medium finding that sits on the only path to your customer data matters more than a critical finding on an isolated test server.

Where to intervene

The useful output of this exercise is not the chain itself. It is the small number of places where one change breaks many paths at once, and those are usually where the budget should go first.