Questions about Pathbreak

Pathbreak finds the privilege escalation paths in your AWS accounts, validates each one read-only by resolving the real authorization, and ranks the fixes by how many paths they break, with the exact command for each. It also runs the exposure checks and compliance scoring you would expect from a scanner, so it can replace one or run alongside it.

An attack path is the chain of steps, often across identities, roles, trust relationships and resources, that an attacker links together to move from an initial foothold to administrative control or sensitive data. Pathbreak finds and validates these paths in AWS and names the change that breaks each one.

Traditional scanners and CSPM tools list thousands of isolated findings. Pathbreak reasons across your whole environment, validates which paths are exploitable by resolving the real authorization, read-only, and reports only the ones that resolve, with the fix that severs each chain.

Pathbreak is available for AWS today, with the deepest coverage of AWS control-plane chains such as IAM privilege escalation and cross-account trust abuse. Azure and Microsoft Entra ID come next, with Google Cloud and hybrid on the roadmap.

Agentic cloud security uses autonomous agents to continuously map, reason about and validate risk. Pathbreak pairs that automation with the judgment of offensive and defensive practitioners, so the agent reasons the way an attacker would instead of applying static rules.

It can. Pathbreak runs hundreds of continuous security checks across your cloud and maps them to compliance frameworks, so it can stand in for a standalone scanner or CSPM. The difference is that it also validates real attack paths, which most of those tools don't, so you consolidate without losing depth. It also works alongside your existing stack if you would rather keep it.

Pathbreak fits Adversarial Exposure Validation (AEV): it validates the real attack paths an attacker could chain across your cloud and shows the single change that breaks each one, which maps to the validation and remediation stages of a Continuous Threat Exposure Management (CTEM) program. It is not Breach and Attack Simulation (BAS); BAS checks whether security controls detect isolated techniques, while Pathbreak validates exploitable attack paths read-only, by resolving the real authorization, and shows how to sever them. It is cloud-native and agentic, focused on AWS control-plane paths today, with Azure and Entra ID next.

Every scan is scored against 44 frameworks, including SOC 2, ISO 27001 (2013 and 2022), PCI DSS 3.2.1 and 4.0, HIPAA, NIST 800-53, 800-171 and CSF, the CIS Benchmarks, AWS Foundational Security Best Practices, the AWS Well-Architected security pillar, ASD Essential Eight and C5. It monitors on a schedule and produces audit-ready evidence from the same scans.

Pathbreak is built by offensive cloud security practitioners and the team behind redamon, an open-source agentic red-team framework with 3,000+ GitHub stars. We find these attack paths by hand, then encode that experience into the platform.

No. Pathbreak reads your control-plane metadata and resource configuration, such as IAM policies, roles, trust relationships and the settings where credentials are commonly exposed. It does not read your object storage or database contents, and detected secret values are not kept. When a scan finds an exposed AWS access key it keeps only the public key ID so the remediation can name the key; the secret access key is never read or stored. It runs on an LLM you provide, under your own credentials, and does not use your data to train any model. The exposures and attack paths it finds are visible only to your team, are never used for anything else, and are deleted on request.

Pathbreak is developed independently. It is not built or trained on customer data, on community or training-platform data, or on data from Pwned Labs, which is a separate company. Its analysis is deterministic: it resolves your real authorization by querying a graph of your actual cloud configuration, so a path is confirmed rather than predicted by a model. The LLM you connect handles language, exploration and explanation. It does not decide whether a path is real.

The control plane is the identity, trust and configuration layer of the cloud, such as IAM policies, role assumptions and directory roles. It is where the most damaging moves happen, and where Pathbreak specializes.