English
Español
Français
Deutsch
日本語
한국어
العربيةIntroducing Pathbreak
Key takeaways
- Pathbreak finds the attack paths in your cloud that a real attacker would use, and proves they work.
- It reasons across your identities, roles and trust relationships, then confirms each chain by resolving the real authorization. It works read-only.
- For every path it confirms, you get the one change that breaks it, so you fix that edge instead of triaging thousands of findings.
- AWS today, with deep coverage of control-plane moves like IAM privilege escalation and cross-account trust abuse. Azure and Microsoft Entra ID are next.
- It's Adversarial Exposure Validation (AEV), it feeds a CTEM program, and it is not breach and attack simulation.
Most security tools are good at listing what is wrong in your cloud and poor at ranking it. They scan every account, report thousands of findings, and leave your team to work out which handful an attacker could string together, so the backlog grows and the one misconfiguration that gets you owned sits in row 4,000 where nobody has time to dig it out.
We built Pathbreak to answer the other question: which chains in your cloud connect all the way to an administrator or sensitive data.
How attackers move
Attackers look for routes through a cloud. The question they ask is how to get from a foothold to an administrator or to sensitive data. That route is an attack path, a chain of small steps across identities, roles, trust relationships and resources, where each step looks unremarkable on its own but strung together they reach the account administrator.
A single permission, a role you can assume, an over-scoped policy nobody remembers attaching: none of these is worth an alert on its own. The chain they form is, and scanners miss it because they check each piece separately.
What Pathbreak does
Pathbreak builds a graph of your cloud's real identities, roles, and trust relationships. An agent explores that graph looking for chains that could escalate privilege, turning questions into precise queries, and then resolves the authorization end to end to confirm which of those chains reach an administrator or sensitive data. When a chain resolves, Pathbreak shows you the path and the exact change that breaks it.
There's more on the mechanics in how it works and the chains we cover on the attack paths page. We find the candidate chains, prove which ones are real by resolving your authorization, and give you the single edit that severs each one.
What we mean by validated
Plenty of tools will draw you a graph of everything that could theoretically happen, and most of those edges fail once you resolve the authorization behind them. Pathbreak follows the real authorization end to end and confirms the path resolves, so you do not have to test it by hand to find out whether it works.
It does all of this read-only. Pathbreak reasons over identity and policy metadata to work out whether a chain is exploitable, so nothing runs against your resources and nothing is changed. We go into that on the Trust and Security page, because a product that maps how to take over your cloud should be careful with the keys.
Where it runs today
Today Pathbreak is built for AWS and goes deep on the control plane: IAM privilege escalation and cross-account trust abuse. Azure and Microsoft Entra ID are next, with Google Cloud and hybrid on the roadmap. We would rather be strong on one cloud than average across five.
Where Pathbreak fits
If you like category labels, this is Adversarial Exposure Validation, and it feeds straight into a CTEM program. Pathbreak validates exposure continuously and reports only the paths that are reachable.
What's next
We'll keep writing here about the specific chains we run into, how control-plane privilege escalation plays out in AWS, and how to work out which findings chain into a path and which go nowhere. Pathbreak is available today. If you want to see the attack paths in your own AWS accounts, come say hello.
Frequently asked questions
What is Pathbreak?
Pathbreak is an agentic cloud security platform that discovers and validates the real attack paths a threat actor could chain across your cloud, then hands you the single change that breaks each one. It runs read-only and reports the small number of paths that resolve, out of the thousands of findings a scanner would list.
How is Pathbreak different from a scanner or CSPM?
Scanners and CSPM tools list isolated findings. Pathbreak reasons across your whole environment, validates which chains are exploitable by resolving the real authorization, and shows only the paths that resolve, with the fix that severs each one.
Is Pathbreak breach and attack simulation?
No. Pathbreak does not fire test payloads at your controls to measure detection. It reasons over your real authorization to prove where an attacker could get, read-only. It is Adversarial Exposure Validation, and it feeds a CTEM program.
Which clouds does Pathbreak support?
Pathbreak is built for AWS today, with the deepest coverage of control-plane chains such as IAM privilege escalation and cross-account trust abuse. Azure and Microsoft Entra ID are next, with Google Cloud and hybrid on the roadmap.
Want to see the real attack paths in your cloud, then break them?
Request a demo