What is attack path analysis?
Attack path analysis maps how an attacker gets from a foothold to the secrets, databases and admin roles you can't afford to lose. A public load balancer, a CVE that enables RCE and an over-permissive IAM role are three rows in three tools. Chained, they're one path to your payments key. Subimage rebuilds your attack graph after every hourly sync and walks it like an attacker.
“What I loved is that you're showing the connections: what an attacker would actually want to get their hands on.”
Start where an attacker starts
- Load balancers, API Gateways, and serverless or container services open to the internet
- VMs with SSH or RDP open to the internet
- Public buckets and internet-exposed databases
- EKS, GKE and AKS control planes with public endpoints
Attack paths a cloud-only CNAPP can't draw
Subimage models over 100 attacker capabilities across AWS, GCP, Azure, Kubernetes, GitHub, Okta, Entra, Spacelift and Tailscale.
- A phished Okta user into AWS through an Identity Center permission set
- A poisoned GitHub Actions workflow into a prod IAM role over OIDC
- A GitHub repo write into a Spacelift run holding your cloud credentials
- A device on your tailnet into internal services, past the perimeter
Assume breach. See how far it goes.
Pick any pod, VM or IAM user and treat it as compromised. Subimage maps its blast radius: everything that foothold can reach.
Running Wiz? Put its findings on the attack path.
Wiz and Orca findings land on the resources they describe, in the same graph as your Okta users, GitHub workflows and Kubernetes service accounts. Any finding on a path picks up the full chain and the team that owns the fix. Or replace them and make Subimage your attack path analysis tool.