Verify the Exploit, Validate the Path

Open the attack-path view in any modern cloud security tool and you'll see hundreds of paths, sometimes thousands, most of them marked critical. Every one ends somewhere that matters. You can't work them all, and the tool can't tell you which ones would actually fire.

That problem is getting worse, because attacker economics used to do quiet defensive work for you. The deepest paths in your environment went unexploited not because they were closed, but because no human attacker found them worth the time. Anyone who has run offense knows the move: try the two or three steps most likely to pay off, walk away from the rest.

No new paths appeared. Paths that were always there became worth walking, and the exposure exercise window on them is collapsing. That makes attack paths matter more than ever. It doesn't make the path count a useful number.

Chaining stopped being expensive

Deep paths aren't the only thing agents finish. They chain flaws that were never meant to be dangerous alone: an information leak nobody prioritized, a privilege escalation rated "exploitation unlikely", a Medium that a "patch everything 7 and above" policy parks.

CVSS scores each vulnerability on its own, so a chain only gets a score if someone works it out. Working it out used to take a skilled person days. Now it's cheap, which means the question has to be asked of your environment as a whole: which combination of flaws, misconfigurations and permissions reaches something that matters? More of the data is on What AI changed.

A path on a graph is a hypothesis

Path discovery is becoming table stakes: wire up the scanners, identity and cloud control plane, build the graph, watch the paths light up. A graph engine will hand you more paths than your team can ever look at, and most of them will never fire.

A path is a claim about what could happen if a chain of conditions all holds, from an entry point to something worth taking. Misconfigurations, over-privileged identities and CVEs each supply hops, and the path only fires if every one of them holds in the environment as it actually runs.

Real chains often carry more than one CVE: a Medium on the web VM that leaks a session, then a privilege escalation on the next host. Each one gets its own five-layer check where it sits, and the chain is ranked by what it reaches, not by the score of any single link.

Enumerate without verifying and you've traded a severity-sorted queue of noise for a path-sorted one.

Verify every exploit, validate the paths that matter

Proof comes in layers, and each one costs more than the last. The trick is spending each where it pays.

1. Every path on the graphDiscovered from scanners, identity and the cloud control planeHypothesis
2. Exploits verified on the resourceAll five layers checked by reading state. Cheap enough to run on every finding, continuouslyVerified
3. Steps validated between resourcesOn the paths that reach what matters: each route, credential and permission tried, without firing an exploitValidated
4. Exploit depthYour red team or pentest tools, pointed at the top of the listExploited

Verification answers whether the CVE can actually be exploited where it sits, and it runs everywhere because it only reads. It removes a large share of paths on its own: if the exploit can't work on the VM, nothing beyond the VM matters. What's left can be ranked by what it reaches. A path that ends at the customer DB or an admin role outranks one that ends at a build cache, whatever the CVSS score of the CVE along the way.

The top of that ranking deserves more than a read. A model of the environment can be wrong in ways reading state won't show, like a control nobody documented that quietly blocks a step, or a permission that resolves differently at runtime. So for the paths that reach high-value targets, validate the steps between resources live: try each route, credential and permission and observe what happens. Nothing is exploited and nothing is left changed.

That last row is the part most programs never get. Validating a path live also tells you whether your SIEM or EDR noticed. A path that holds end to end and trips nothing is worth more of your attention than one that holds and lights up the SOC.

Exploit depth still has its place. Some questions need a real exploit fired under your authorization, and that stays with your red team and your pentest tools. The difference is where they start: on the validated, ranked paths instead of a raw backlog. For why that line sits where it does, see You shouldn't have to break production to know what's broken.

The number that matters

Once you have that, the next step gets shorter. Verified paths often share a chokepoint, and one change there can close more of them than a week of patching. Patching is not the only move covers where to act. For how Defendermate verifies and ranks paths, see Analyze.

Sources: Anthropic, Claude Mythos Preview findings (April and June 2026); Microsoft and CISA advisories for CVE-2025-49706 and CVE-2025-49704, scores from the CVE records; Defendermate analysis of the CISA KEV catalog and CVE records, October 2026. Details and links on What AI changed.