Dashboard guide
Attack paths
A single vulnerability says little about real risk. The Attack paths page combines findings, reachability and the accounts services run as into paths: how an attacker could get in and how far they could get. Everything is built from measured data on your hosts. The page is read-only for every role.
Worst case
At the top: the worst case for your environment, drawn as a chain from Internet via a host and a service to the end result (for example "full control" of a host). Each step shows how certain it is:
| Certainty | Means |
|---|---|
| confirmed | measured, for example the external probe connected, or an internal check from the previous host succeeded |
| likely | follows from the configuration, for example a public address with a listening service that the host firewall does not block |
| assumed | possible but not proven, for example a vulnerability whose type usually allows code execution |
A step without evidence is never drawn as an arrow. Where reachability was not measured, the page shows a dotted line "not measured" instead. The worst case can be shown in English or Dutch.
Detected combinations
Below the worst case: the detected paths, filtered by Open, Broken (fixed) or All. Each path has a class (like the finding buckets), the entry host, a score, its status and when it was last seen. Show path expands the steps. The rules that make a path:
| Rule | A path when |
|---|---|
| Internet exposed | The external probe confirmed that a service is reachable from the internet (directly, or through a port forward on your own WAN address). This is a path even without a vulnerability. Remote administration, file sharing and databases weigh more than web services. |
| Public KEV | A finding that is known to be exploited (KEV) on a service that is reachable from the internet. |
| Entry + privilege escalation | A publicly reachable, exploitable entry, plus a local privilege escalation on the same host. |
| Lateral to a crown jewel | An exploitable entry, plus measured internal reachability from that host's network to a host tagged as crown jewel, with a vulnerability on exactly the reached port. |
Mark your most important hosts as crown jewel (tag crown_jewel on the agent). They weigh more in the score and
make lateral paths visible.
Break the path at the cheapest step
Each path lists breakers: actions that break one step, cheapest first. For example:
- patch the vulnerable package of a step;
- restrict the entry port to private networks with a firewall rule;
- restrict a crown jewel's port to its own segment;
- remove a port forward on your router (a manual step: SEK Systems never changes network equipment).
A breaker is carried out as a normal plan, with dry run, approval and maintenance window. When any step of a path disappears (patched, port closed, the probe no longer sees it), the path is marked broken at the next calculation: attack path no longer present: at least one step was broken.
Paths are recalculated about two minutes after new matching results, and every 30 minutes for all environments.