Attack Path Analysis
See how an attacker chains exposure, identity, and privilege to reach what matters.
What this replaces
A list of thousands of findings can't tell you which three, chained together, actually reach a sensitive data store. Severity alone misses the combination; the risk lives in the path, not the point.
What Offload does
A graph engine that connects internet exposure, cloud resources, identities, and privilege-escalation relationships into traversable attack paths — then ranks them by what they reach and shows the fewest fixes that break the most paths.
What you get
- Breadth-first path traversal over a unified security graph — network, identity, and privilege-escalation edges
- Identity-aware: has-access and can-escalate-to edges derived from IAM analysis (admin and over-privileged principals)
- Toxic-combination rules mapped to MITRE ATT&CK
- Crown-jewel tiering so paths are ranked by the value of what they reach, not just finding severity
- Choke-point analysis: the edges that, cut, break the most critical paths
- Remediation simulation: model 'if we fix these, critical paths drop from N to M' before committing
- Hybrid cloud + on-premises graph — internet, cloud workloads, and Wazuh-discovered on-prem hosts in one model
How it works
Cloud assets, findings, identities, and on-prem hosts are ingested into one graph. Identity edges are derived from IAM analysis — an admin or over-privileged principal is linked to the data stores it can reach and the admins it can escalate into.
Path enumeration runs breadth-first from internet-exposed entry points to high-value targets, then analytics rank paths, surface choke points, and simulate remediation. Identity edges are relationship-derived heuristics, not per-resource policy simulation — designed to surface real chains for review, not to replace an IAM policy evaluator.
One platform, one risk view
Attack paths draw on the same cloud, Kubernetes, and identity data as the rest of the platform, and feed path context into the risk register — one graph over everything already scanned.