Your findings list tells you what's wrong. It can't tell you what's reachable.

Attack Paths works from a different input: the actual shape of your estate. Which AWS resources are exposed, which roles can be assumed by whom, which principals can read what. Those relationships are what a path is built from, whether or not anything along the chain has ever been flagged as a problem.

It's live in Infrastructure Discovery now, and there's nothing to install. If your AWS accounts are already connected, it's in your dashboard.

What's new

Paths built from configuration, not from CVEs A path exists because something is exposed, some permission is broader than intended, and something valuable sits at the end of it. Findings from Security Hub, Inspector, and GuardDuty can raise a path's priority, but they never create one and never gate one. Plenty of the paths worth your time have no finding attached anywhere along the chain.

Ranked paths, shown as a map Every path runs from an entry point, through any pivots along the way, to a crown jewel. You get the whole chain as a map, with a severity band and a plain-English reason it landed where it did.

Crown jewels you choose yourself You decide what counts as high value in your estate. Pin and unpin assets from the console, and path scoring reorganizes around your choices instead of our assumptions about your business.

Key nodes: entry points and choke points Entry points are ranked by what they actually open up. Choke points are the nodes that the most paths run through, which is usually where a single change does the most work.

Identity, not just network reachability Paths follow IAM as closely as they follow the network: role chaining, pass-role, policy attachment, self-escalation, and principals holding effective admin through AWS managed policies.

Why it matters

A severity list ranks problems one at a time, and it's genuinely good at that. What it can't do is tell you that a role you granted a vendor two years ago, with "read-only" in its name and a wildcard in its policy, sits one hop from every secret you own. There's no CVE on that role and nothing about it is broken. Someone made a reasonable call and the blast radius grew around it quietly. That's a path, and paths are what this is for.

Where to find it

Infrastructure Discovery → Attack Paths. 

Attack Paths is included in your Infrastructure Discovery license. No separate SKU, no add-on charge.

Full details in the Infrastructure Discovery documentation.