01
Start with external exposure
Use an Attack Surface Management (ASM) perspective to review externally exposed assets and accessible services.
WERANA / Services
Attack surface & paths
Could an exposed connectionlead to a critical asset?
Follow exposed services and asset relationships, reviewing the evidence behind each path and the gaps that need further investigation.
Review workflow
Follow exposed services to critical assets.
Review potential connections to important services, together with the evidence behind each relationship.
- 01External connection
- 02Business service
- 03Critical asset
02
Trace paths to critical assets
Review Network Topology and Service Dependency relationships as part of Attack Path Analysis.
03
Review response points with evidence
Assess path priority while distinguishing observed, configured and inferred evidence from unverified segments.
Environment & coverage
What can you review in your environment?
Review the applicable scope based on your assets, collection permissions, and existing security operations.
Security categories to compareEASM · CAASM · CTEM · BAS
Attack surface & paths
Available paths depend on collected relationships and enabled analysis capabilities.
What to discuss
- External exposure and collected service relationships
- Critical-asset classification and relationship data
- Availability of path-analysis capabilities
FAQ
Frequently asked questions
Does a visible path prove a breach?
A path describes potential connections and their evidence. Its presence alone does not establish a breach.
How do EASM and CAASM relate to attack path analysis?
EASM examines the externally visible attack surface; CAASM reconciles assets and security information across sources. This service reviews potential paths using collected external connections, services and critical-asset relationships. Confirm external discovery and integration coverage for your environment.
Does path analysis include the attack validation used in CTEM or BAS?
CTEM is an ongoing approach spanning exposure identification, prioritization, validation and remediation. BAS uses simulated attacks to validate controls. Reviewing potential paths here is separate from executing attacks or validating successful exploitation. A path alone does not establish a breach or successful attack.
Start with the scope that fits your environment.
Tell us about your environment and security priorities. We will help review supported capabilities and collection requirements.