Attack path analysis is software that builds a model of a company's whole network and works out what can reach what: which computer can connect to which other computer, through which firewalls and routers, and on which ports. Security teams use it to see where an attacker from the internet could get in, and how far the attacker could go. The model is a digital twin of the network, a complete software copy of it.
Why is this hard? A large company's network has hundreds of firewalls, routers and switches, in offices, in data centres and in several cloud accounts. Each device has its own settings. A firewall, for example, has a list of rules. Each rule says which addresses may connect to which other addresses, and on which port. A port is a number that identifies one service on a computer; secure web traffic usually uses port 443. A large firewall can have 5,000 rules, written by different people over ten years. No person can read all of them and say whether the internet can reach the customer database.
The software collects the settings of every device: firewalls, routers and switches and cloud networks. It reads them, but changes nothing. From them, it calculates every path that a packet of data could take. Then engineers can ask questions in plain terms, such as "Can anything on the internet reach the payment servers?" or "Which offices can connect to the HR system?"
Consider a general insurance company in Delhi with 380 network devices and three cloud accounts. Its security team asks the model one question: can the internet reach the server that stores customers' health claims? The answer comes back in a minute: yes, by one path. A web server in the cloud accepts traffic from the internet. A firewall rule, added in 2021 for a project that has since ended, still allows that web server to connect to the claims database. Nobody had noticed, because each rule made sense on its own. The team removes the old rule. The model confirms that no path remains.
The product has one part. Attack path simulation adds the list of known flaws found by the vulnerability scanner, and shows which flaws an attacker could actually reach.
How is it different from a firewall? A firewall blocks traffic. Attack path analysis blocks nothing. It only tells people what their firewalls allow. It is also different from micro-segmentation, which puts a small protected zone around each server and enforces it. The model can check whether those zones really block what they are meant to block. A network digital twin builds the same kind of model for network engineers, who use it to find faults and to test changes before they make them.