The Question
Vulnerability management programs are optimized to find and remediate high-severity CVEs. The logic is intuitive: a critical-severity vulnerability represents greater risk than a low-severity one, so patching critical vulnerabilities first reduces the most risk per remediation unit. CVSS scores encode this logic systematically. Most VM programs are built around it.
The problem with this logic is that attackers are not constrained by it. An attacker who cannot find a single critical-severity path to a high-value target does not give up — they chain together whatever exposures are available until a path exists. A password in a text file (not a CVE) plus an overprivileged service account (a misconfiguration, not a CVE) plus an unconstrained delegation relationship (an Active Directory configuration issue, not a CVE) produces Domain Admin access without touching a single critical-rated vulnerability.
Vulnerability management handles each of these findings independently, if it handles them at all. The text file with the password may not be in scope for a vulnerability scanner. The overprivileged service account is an IAM issue, not a VM finding. The unconstrained delegation is an AD configuration that requires a separate tool to detect. No individual finding triggers a critical alert. The chain that connects them produces complete environment compromise.
Security programs that optimize for remediating individual high-CVSS vulnerabilities are optimizing against the attack model of the 1990s — modern attackers build paths from whatever exposures exist, and the defense that matches them must model the same chains.
Why This Matters Now
The SolarWinds supply chain attack of 2020 set the template for chain-based intrusion at national security scale. The SUNBURST implant did not rely on a single critical CVE — it relied on a chain of design choices, build process access, and trust relationships in the software supply chain that individually appeared acceptable and collectively produced one of the most significant intelligence collection operations ever conducted against U.S. government and enterprise targets.
The pattern has repeated at the enterprise ransomware level throughout 2024 and 2025. The Akira ransomware group, active throughout 2024 and the subject of a joint CISA/FBI/Europol advisory, documented a standard attack chain that included: VPN access using compromised credentials or CVEs in unpatched VPN appliances, credential extraction using tools like Mimikatz or LaZagne, lateral movement through administrative shares and RDP, Active Directory reconnaissance using SharpHound (the BloodHound data collection tool), privilege escalation via identified AD attack paths, and ransomware deployment. At no stage does the chain require a single critical-severity CVE if the attacker has obtained valid credentials and the Active Directory environment contains standard misconfigurations.
The specific finding that should concern security leaders is the data from MITRE ATT&CK Enterprise: the techniques most commonly observed in real-world intrusions are not primarily associated with exploitation of high-severity CVEs. Credential access, lateral movement, and discovery techniques — which typically involve misconfigurations, trust relationships, and privilege exposures rather than exploitable software vulnerabilities — appear in the majority of documented intrusion sequences. Vulnerability management addresses a subset of the attack chain. CTEM addresses the full chain.
What the CURVE™ Data Shows
The 2026 Stackcurve CTEM CURVE™ Report evaluated the attack path analysis and exposure chaining market across five capability dimensions: chain modeling depth, Active Directory coverage, cloud attack path coverage, continuous simulation cadence, and validation-stage integration.
XM Cyber is the leader in continuous attack path simulation with AI-powered modeling. The platform continuously simulates all possible paths through the environment to defined crown jewel systems, scoring each exposure by its contribution to critical attack paths rather than its individual CVSS severity. The AI-powered approach allows XM Cyber to model chaining across heterogeneous environments — on-premises, cloud, and hybrid — at a depth that periodic penetration testing cannot replicate. BloodHound Enterprise (SpecterOps) is the definitive platform for Active Directory attack path analysis. The platform's graph-based model of AD relationships — including Kerberoastable accounts, AS-REP roasting targets, unconstrained and constrained delegation configurations, and ACL-based privilege escalation paths — provides continuous monitoring of the AD attack surface with managed remediation guidance. BloodHound's open-source lineage and the depth of SpecterOps' Active Directory research give it unmatched credibility for AD-specific chaining analysis.
Cymulate ExposureX provides BAS-integrated attack path analysis, combining simulated attack execution with path modeling to validate which chains are not just theoretically possible but actively exploitable in the current environment. Mandiant Security Validation differentiates on threat intelligence integration — modeled chains are mapped to documented threat actor TTPs, providing business context for prioritization. Palo Alto Cortex Attack Path Analysis provides the tightest integration with the broader Cortex CTEM ecosystem for organizations already operating in that platform context.
The full vendor rankings are in the 2026 Stackcurve CTEM CURVE™ Report — free to download.
The Gap Most Buyers Miss
The exposure chaining problem is well understood in offensive security circles — penetration testers have been building chains from low-severity findings for decades. What is underappreciated is how systematically this approach is used in real-world attacks, and how inadequately current defensive tooling addresses it.
1. Vulnerability scanners do not model chains — by design. Nessus, Qualys, Rapid7 InsightVM, and Tenable.io are designed to find discrete vulnerabilities in individual assets and rate them by CVSS severity. They are not designed to model how findings combine. A vulnerability scanner that finds an MS14-068 Kerberos privilege escalation vulnerability and separately finds an overprivileged service account will report two findings with their individual severity scores. It will not model the chain in which the two findings combine to produce immediate Domain Admin access. This is not a failure — it is an accurate description of the problem scope that vulnerability scanners solve. The problem is when organizations treat VM output as their complete exposure picture.
2. Non-CVE exposures are systematically underweighted or excluded. The classic chain example illustrates the scope problem: a password stored in a plaintext file in a network share is not a CVE. It will not appear in a vulnerability scanner's output. It will not have a CVSS score. Yet it is arguably the most dangerous single finding in the chain — the one that provides the initial credential that enables everything else. CTEM requires a broader exposure definition than vulnerability management: misconfigurations, credential exposures, overprivileged accounts, trust relationship misconfigurations, and physical/logical access policy violations are all in scope. The organizations that expand their exposure definition to match this scope — through ISPM tools, AD assessment, and CSPM — close the gap between their defensive model and the attacker's exploitation model.
3. Static attack path analysis degrades quickly in dynamic environments. A penetration test or red team exercise produces an accurate picture of attack paths as they exist on the day of the assessment. Enterprise environments change continuously: new systems are provisioned, service accounts are created, trust relationships are added, cloud infrastructure is modified. An attack path that was remediated six months ago may have been recreated by routine operational activity. Continuous attack path analysis — which models the current state of the environment at all times rather than the state at assessment time — is the only approach that matches the dynamic nature of modern enterprise environments. This is the core value proposition of XM Cyber and BloodHound Enterprise: continuous, not periodic, attack path visibility.
4. The AI contribution to chaining analysis is genuine, not marketing. The computational challenge in attack path analysis is that the number of possible paths through a complex enterprise environment grows combinatorially with environment size. A 10,000-node environment with multiple trust relationships, IAM configurations, and software exposures has an astronomical number of potential chains to model. AI-powered path analysis — which uses graph algorithms and machine learning to identify the paths most likely to produce high-impact access and to prioritize findings by their contribution to critical paths — is a genuine capability improvement over rule-based path analysis at enterprise scale. XM Cyber's AI-powered attack graph specifically addresses this computational challenge.
5. The CTEM validation stage is what distinguishes theoretical chains from confirmed exploitable paths. Attack path modeling produces a probability-weighted map of potential exploitation chains. The CTEM validation stage — Stage 4 in the Gartner CTEM framework — confirms which modeled chains are actually exploitable in the current environment through controlled validation techniques. BAS platforms (Pentera, Cymulate) perform the validation function by executing simulated attack techniques against the real environment with controlled scope and blast radius. The distinction between "modeled as possible" and "confirmed exploitable" is operationally significant: remediation resources should be concentrated on confirmed chains, with modeled-but-unconfirmed chains in the second priority tier.
Questions Your Buying Team Should Be Asking
1. How does the platform model chains that include non-CVE exposures — misconfigurations, credential issues, and trust relationship abuse? This is the fundamental differentiation question for attack path analysis. Ask the vendor to demonstrate a chain that originates from a credential exposure rather than a CVE, includes an AD misconfiguration in the path, and terminates at a defined crown jewel system. The platform that can model this chain is providing exposure chaining capability; the platform that only models CVE-to-CVE paths is providing enhanced vulnerability management, which is a different (and lesser) capability.
2. How frequently is the attack path model updated to reflect changes in the environment? The answer should be measured in hours, not days or weeks. Ask specifically: if a new service account is created with Domain Admin rights at 2 PM today, when will that account appear in the platform's attack path model? If a new EC2 instance is provisioned with an overprivileged IAM role at 3 PM, when will the path from that instance to other cloud resources be visible in the platform? The cadence of model updates determines the window during which new exposures exist outside the defensive picture.
3. How does the platform prioritize remediation guidance — which path nodes should be remediated first to eliminate the most attack paths? The correct remediation insight from attack path analysis is not "fix everything in this chain" but "fix this specific node, which appears in 847 distinct attack paths to your crown jewel systems." Attack path analysis platforms should provide remediation prioritization based on node centrality — the exposures that, if remediated, eliminate the greatest number of high-impact paths. This prioritization logic is more actionable than CVSS severity ranking and should be the primary output of any attack path analysis deployment.
4. What is the validation methodology — how does the platform confirm that a modeled path is actually exploitable, not just theoretically possible? Theoretical path analysis and confirmed exploitability are different claims. Understand whether the platform uses passive path modeling (which identifies theoretically possible chains based on configuration analysis) or active validation (which executes controlled attack simulations to confirm chains work). For regulated environments, understand the authorization and scoping model for active validation, and what guardrails exist to prevent validation activities from impacting production systems.
5. How does the platform handle path analysis across cloud and on-premises environments in hybrid deployments? The attack paths that matter most in hybrid environments are often the ones that cross the cloud/on-premises boundary: an on-premises credential used to authenticate to a cloud management console, an overprivileged cloud identity used to access on-premises resources through VPN trust, or an AD group used to control access to both on-premises and Azure AD-joined systems. Ask for a demonstration of cross-boundary path analysis in an environment that resembles your deployment architecture, and specifically ask which integration methods are used for cloud environment discovery — agentless versus agent-based approaches have different coverage and latency characteristics.
The Stackcurve Take
Exposure chaining is not an edge case or an advanced attack technique reserved for nation-state actors. It is standard practice for any competent attacker targeting enterprise environments, and it has been for years. The ransomware operators, IABs, and penetration testers who routinely compromise enterprises with mature vulnerability management programs are doing so, in most cases, through chains of individually unremarkable findings.
The defensive response is not to eliminate all individual findings — that is operationally impossible in any organization of meaningful size. The response is to model how findings chain, identify which chains lead to high-impact access, and remediate the nodes in those chains with the urgency that the chain-level risk warrants, regardless of the individual CVSS scores of the component findings.
This is CTEM's core contribution to security operations. Not finding more vulnerabilities — finding the specific vulnerabilities that matter in the context of the full attack graph, and building a remediation program around that context rather than around a severity score that was never designed to reflect how attackers actually move through environments.
Organizations that make this transition — from CVSS-sorted patch queues to attack-path-prioritized CTEM programs — are not just operating more efficiently. They are defending against the threat model their attackers are actually using. That alignment between defensive program and offensive tradecraft is what drives meaningful risk reduction, measured in incidents prevented rather than CVEs patched.
The 2026 Stackcurve CTEM CURVE™ Report covers attack path analysis and exposure chaining platforms in depth, including detailed assessments of XM Cyber, BloodHound Enterprise, Cymulate ExposureX, and the BAS platforms that provide validation-stage confirmation of modeled chains. Download it free →
Stackcurve Advisory Briefs are independent research. No vendor pays for placement, tier assignment, or editorial influence. The CURVE™ methodology is disclosed in full at stackcurve.net/research/methodology.