Implementing Attack Path Analysis with XM Cyber

Overview

XM Cyber is a continuous exposure management platform that uses attack graph analysis to identify how adversaries can chain together exposures -- vulnerabilities, misconfigurations, identity risks, and credential weaknesses -- to reach critical business assets. According to XM Cyber's 2024 research analyzing over 40 million exposures across 11.5 million entities, organizations typically have around 15,000 exploitable exposures, but traditional CVEs account for less than 1% of total exposures. The platform identifies that only 2% of exposures reside on "choke points" of converging attack paths, enabling security teams to focus on fixes that eliminate the most risk with the least effort.

When to Use

• When deploying or configuring implementing attack path analysis with xm cyber capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• XM Cyber platform license and tenant access
• Network connectivity to monitored environments (on-premises, cloud, hybrid)
• Administrative access for agent deployment or agentless integration
• Cloud provider API access (AWS, Azure, GCP) for cloud attack path analysis
• Active Directory read access for identity-based attack path modeling
• CMDB or asset inventory defining critical business assets

Core Concepts

Attack Graph Analysis

Unlike point-in-time vulnerability scanning, XM Cyber continuously models all possible attack paths across the entire environment:

Key Metrics from XM Cyber Research (2024)

Choke Point Concept

A choke point is a single entity (host, identity, credential, misconfiguration) that sits at the intersection of multiple attack paths leading to critical assets. Fixing a choke point eliminates many attack paths simultaneously, providing maximum risk reduction per remediation effort.

Attack Path 1:  Web Server -> SQL Injection -> DB Admin Creds
                                                    \
Attack Path 2:  VPN -> Stolen Creds -> File Server   -> Domain Controller
                                                    /     (Critical Asset)
Attack Path 3:  Workstation -> Mimikatz -> Cached Creds
                                    ^
                              CHOKE POINT
                     (Cached Domain Admin credential)

Exposure Categories

Workflow

Step 1: Define Critical Assets (Business Context)

Critical Asset Definition:
    Tier 1 - Crown Jewels:
        - Domain Controllers (Active Directory)
        - Database servers with PII/financial data
        - ERP systems (SAP, Oracle)
        - Certificate Authority servers
        - Backup infrastructure (Veeam, Commvault)

    Tier 2 - High Value:
        - Email servers (Exchange)
        - File servers with IP/trade secrets
        - CI/CD pipeline servers
        - Jump servers / PAM vaults

    Tier 3 - Supporting Infrastructure:
        - DNS/DHCP servers

…