Attack path simulation is software that works out the routes an attacker could take from the internet to a company's most valuable systems, so that the flaws an attacker can actually reach are fixed first. It is a part of attack path analysis, and is also called attack path modelling or exposure analysis.
Why is it needed? A vulnerability scanner checks every machine against the public list of known flaws, the CVE list. A large company gets thousands of findings. Each finding has a severity score from 0 to 10. But the security team cannot fix everything at once. A severity score says how bad a flaw is in general. It does not say whether an attacker can reach this particular machine. A critical flaw on a server that nothing can reach is less urgent than a smaller flaw on a server that is open to the internet.
The simulation joins two things. The first is the network model: which machine can connect to which, through which firewalls. The second is the list of flaws on each machine. The software starts from the internet, as an attacker would. It finds every machine that the internet can reach. For each one that has a flaw, it assumes that the attacker breaks in, and asks what that machine can reach in turn. It repeats this, step by step, until it reaches the systems marked as valuable, such as a customer database. Each route it finds is an attack path.
For instance, a stock broking firm in Ahmedabad scans its 2,600 machines and gets 3,200 findings, 140 of them rated critical. The simulation shows that only nine machines with flaws can be reached from the internet. Of those, only two lead on to the trading database, which holds clients' holdings and orders. The first is a forgotten test web server, set up for a mobile app launch two years ago. Its flaw is rated 7.5, which is high but not critical. From it, an old firewall rule still allows connections to the trading database. The second is the firm's VPN gateway, the device through which staff connect from home. It is missing a patch for a flaw rated 9.8. These two go to the top of the list, above the other 139 critical flaws, which no attacker can reach. The team patches the VPN gateway the same day, and switches off the test server.
The ranked list often feeds cyber risk quantification, which turns the findings into an estimate of the possible loss in rupees. Teams also compare the paths with what external attack surface management sees from the internet. Then invited testers in offensive security testing can try the top paths for real, with permission, to prove that they work.
The simulation itself sends no traffic and attacks nothing. It calculates the paths from the model. That is the difference from a penetration test, in which a person actually tries to break in.