Why Attack Path Beats a Vulnerability List

A plant we looked at recently had a maintenance jump host with a weak credential policy. Medium severity. The kind of finding that sits in position 340 of a scanner report, behind the engineering workstation with the unpatched CVE and the exposed management interface on a plant-floor camera. Nobody was losing sleep over it, and on its own, nobody should have been.

Here's what the scanner didn't say. That jump host was reachable from an edge firewall rule someone added two years ago and forgot about. From the jump host there was a path to a plant historian that syncs to a cloud appliance. The historian talked to a line sensor gateway. The gateway sat on the same segment as a safety relay PLC.

None of the individual findings changed severity when we drew that out. What changed is that they stopped being four unrelated rows in a spreadsheet and became a route. An attacker with a foothold at the firewall doesn't need four zero-days to reach the safety relay. They need this one path, and every hop on it already exists in the environment today, unpatched, exactly as found.

That's the whole argument for attack path over a vulnerability list, and it's worth being precise about why a list can't make it alone.

#Severity is not the same question as exposure

A CVSS score answers "how bad is this bug." It does not answer "can anyone actually reach it, and what do they get if they do." Those are different questions, and conflating them is how you end up with a thousand-line report where everything is High or Critical, which functionally means nothing is.

A CISO cannot walk into a board meeting with that list. They also can't ignore it, because the one finding that matters is genuinely somewhere in there. The list gives no way to tell the difference, and that is not a tooling gap so much as a category error: severity was never designed to answer the prioritization question people are asking it.

In OT specifically, this gets worse, not better. The crown jewel at the end of a path is often a physical process. A safety system, a control loop, a piece of equipment you can't un-break by restoring from backup. Telling a plant engineer their historian is missing a patch is hygiene advice. Showing them the historian sits on the only path between an internet-facing router and a safety-critical PLC is a decision they have to act on this week.

#What makes a path worth trusting

We've seen plenty of "attack path" diagrams that don't survive five minutes of scrutiny from an engineer who actually knows the plant. Usually because the tool inferred a connection from network proximity rather than observed evidence, and presented the guess with the same confidence as a fact.

A path that holds up needs three things. Evidence at every hop, not inference: a live session, a routing rule, a credential relationship, something actually observed rather than assumed from two devices sharing a subnet. A confidence level on each hop, because a connection confirmed by an authenticated scan and one inferred from passive traffic are different claims, and treating them identically is how you lose the room the first time someone checks your work. And a ranked, bounded output. Eight paths into a segment usually isn't eight problems; it's one or two chokepoints that collapse most of the paths if you close them. The answer should be "patch these three systems, in this order," not a longer list of things that are also technically true.

That third one is the part most vendors skip, because it requires actually doing the analysis instead of just rendering the graph. It's also the part that turns a security finding into something a CISO can act on without an analyst translating it first.

A vulnerability scanner will keep telling you what's wrong, and you'll keep needing it to. Attack path is the layer on top that tells you which of those thousand things is actually load-bearing, and it's the view we built Breakwater Discover around: every hop evidenced, every claim scored for confidence, the plant firewall-to-PLC story above rendered the same way for whatever's actually running in your environment.