What Is Attack Path Mapping?
Attack Path Mapping (APM) is a security assessment technique that models the realistic routes an attacker would take through your environment, from initial entry point to your most valuable data, so those routes can be broken before a real attacker uses them.
The diagram above shows a typical mapped path: three common entry points converging through an initial foothold into a single choke point, a shared administrator credential, before fanning out toward the organisation’s most critical data. Close that one choke point and every route through it dies. That is the entire value proposition of APM in one picture.
Instead of producing a long list of individual vulnerabilities, APM connects the dots the way an adversary does. A medium-severity misconfiguration on a forgotten server, a shared administrator credential, and an over-privileged service account may each look minor in isolation. Chained together, they can form a complete, walkable path from a phishing email to your financial systems.
Your “crown jewels” are rarely just client lists and email addresses. The data attackers actually target includes detailed financials, profit and loss records, tax filings, intellectual property, merger and partnership information, vendor relationships, and privileged credentials, the information that lets them monetise the breach or pivot into every organisation connected to yours.
Why Traditional Security Approaches Fall Short
Security spending keeps rising, yet breaches keep happening. The reason is structural: most organisations defend assets one at a time, while attackers think in paths.
Modern intrusions rarely start with a dramatic firewall breach. They start quietly:
- Reconnaissance and OSINT. Attackers research your organisation, staff, suppliers, and technology stack using publicly available information, the same open-source intelligence techniques used in OSINT investigations.
- Supply chain and third-party access. Adversaries deliberately target smaller suppliers with weaker security that hold trusted connections into their real target, a pattern first documented at scale in the energy-sector campaigns analysed by US-CERT, and now standard practice in ransomware and espionage operations.
- Identity, not malware. Phishing, stolen credentials, MFA fatigue attacks, and session token theft let attackers log in rather than break in. Once inside, they “live off the land,” using legitimate admin tools that traditional antivirus never flags.
- Cloud and hybrid sprawl. Misconfigured cloud identities, stale service accounts, and shadow IT create alternative infrastructure, paths defenders don’t even know exist.
A perimeter-focused security programme can be fully compliant and still leave a three-step path from a single compromised laptop to domain administrator.
How Attack Path Mapping Works
A Da Vinci Cybersecurity APM engagement follows five stages:
1. Identify the crown jewels
We work with your leadership and IT teams to define what actually matters most: financial systems, client data, intellectual property, operational technology, or regulated information under POPIA.
2. Map the environment through an attacker’s eyes
We enumerate identities, permissions, trust relationships, network segmentation, cloud configurations, and externally exposed assets, combining automated attack graph analysis with manual attacker tradecraft, aligned to the MITRE ATT&CK framework.
3. Build the attack graph
Every viable route from realistic entry points (phishing, exposed services, third-party access, leaked credentials found through dark web scanning) to the crown jewels is mapped and chained.
4. Prioritise choke points
Most attack paths converge through a small number of choke points, a shared credential, an over-privileged group, a flat network segment. Fixing one choke point can eliminate dozens of paths at once. This is where APM delivers dramatically better return on effort than patching vulnerabilities by CVSS score.
5. Remediate and validate
We work alongside your IT professionals to close the paths, educate staff on the human attack surface, and then re-test , often through targeted penetration testing, to prove the routes are genuinely closed.
Attack Path Mapping Tools: Do You Need Software or an Assessment?
Many people arrive at this page searching for attack path mapping tools. Tooling absolutely exists, attack graph platforms such as BloodHound (for Active Directory and Entra ID paths), cloud security posture tools, and commercial exposure management suites can enumerate paths automatically.
But a tool output is not an assessment. Graph tools routinely surface thousands of theoretical paths; the expertise is in determining which paths are actually walkable by a real attacker in your environment, which choke points remove the most risk per fix, and how to remediate without breaking business operations. Da Vinci Cybersecurity uses attack graph tooling as one input alongside manual attacker tradecraft, OSINT exposure analysis, and validation testing, and hands you a prioritised plan, not a raw graph export.
Practitioner’s Note: A Cloud Choke Point in the Wild
From our casework (client details anonymised): During a recent APM engagement for a South African professional services firm, automated scanning showed nothing critical. The attack graph told a different story. A legacy on-premises service account had been synchronised into the client’s Microsoft 365 tenant during a migration years earlier. It held no obvious privileges, but it was excluded from conditional access policies and MFA “temporarily” during the migration, and never re-enrolled.
That single stale identity formed a bridge between a phishable on-premises credential and cloud mailboxes containing the firm’s client financial correspondence, a path invisible to both the vulnerability scanner and the cloud security dashboard, because each tool only saw its own half of the bridge. One remediation (disabling the account and closing the conditional access gap) eliminated every mapped path to that data. Total fix time: under an hour. That is what a choke point looks like in practice.
Attack Path Mapping vs Penetration Testing vs Vulnerability Assessment
| Vulnerability Assessment | Penetration Testing | Attack Path Mapping | |
|---|---|---|---|
| Question answered | What weaknesses exist? | Can we get in? | How would an attacker reach what matters most — and where do we break the chain? |
| Output | Ranked list of vulnerabilities | Proof of exploitability | Prioritised attack graph and choke-point remediation plan |
| Scope | Broad, automated | Targeted, manual | Whole-environment, crown-jewel focused |
| Best used | Continuously | Periodically | As the strategic layer connecting both |
These are complementary, not competing. APM tells you where penetration testing and hardening effort will reduce the most real-world risk. Explore our vulnerability assessment and penetration testing services.
The Business Case for APM in South Africa
- POPIA accountability. Regulators and the Information Regulator expect demonstrable, risk-based protection of personal information. An attack graph is concrete evidence of a risk-led approach.
- Board-level clarity. “Attackers have three viable paths to our financial systems; closing two choke points eliminates all three” is a sentence a board can act on. It translates technical risk into business decisions — the same philosophy behind our board-level cybersecurity reporting and governance, risk and compliance services.
- Cyber insurance. Insurers increasingly ask how you identify and remediate attack paths to critical assets, not just whether you patch. APM strengthens both your posture and your premium negotiation. (See: Should you get cyber insurance?)
- Cost efficiency. Fixing choke points is cheaper than fixing everything. APM focuses budget where it measurably shrinks attacker options.
Frequently Asked Questions
How often should attack path mapping be done? At minimum annually, and after any significant change: cloud migration, merger or acquisition, new remote access solution, or major identity platform change. Environments drift — new paths open constantly.
Is APM only for large enterprises? No. Smaller organisations are frequently the entry point into larger partners, which makes them targets in their own right. A scoped APM assessment for an SME is fast, affordable, and often reveals one or two fixes that remove most of the risk.
Does APM cover cloud environments? Yes. Modern attack paths routinely cross from on-premises identity into Microsoft 365, Entra ID, AWS, and hybrid infrastructure. Any APM that ignores cloud identity is incomplete.
What do we receive at the end of an engagement? A visual attack graph of viable paths to your crown jewels, a prioritised choke-point remediation plan, an executive summary suitable for board reporting, and a validation re-test.
Free Download: Attack Path Mapping Template
Want to run a first-pass exercise internally before commissioning an assessment? Download our free Attack Path Mapping Template & Workbook, a structured worksheet for identifying your crown jewels, listing realistic entry points, sketching candidate paths, and scoring choke points by paths-eliminated-per-fix.
Download the Attack Path Mapping Template (Word)
Where to Go Next
Attack paths almost always begin with the human layer. If your team uses social media, start with how attackers compromise those accounts, see our guides on Instagram account security and TikTok hacking. To understand what attackers can already see about your organisation from the outside, read about our OSINT investigations and Digital Threat Monitoring services.
“Da Vinci Cybersecurity makes use of Attack Path Mapping to identify a company’s vulnerabilities against cyber attack. Critical attack path analysis has repeatedly reduced the number of compromisable systems in our clients’ environments. We work with IT professionals and educate staff to identify and eliminate the realistic routes to a company’s most critical assets.” — Da Vinci Cybersecurity
Speak to an Investigator
Da Vinci Forensics & Cybersecurity delivers attack path mapping, penetration testing, OSINT investigations, and digital threat monitoring for organisations across South Africa.
Contact us to scope an Attack Path Mapping assessment.
