https://breachpath.org An interactive library of realistic attack paths — from initial access to business impact — mapped to MITRE ATT&CK, with the controls, telemetry and red-team tests that break each chain. en-GB https://breachpath.org/notes/account-lockout-and-strong-unique-credentials https://breachpath.org/notes/account-lockout-and-strong-unique-credentials Implement high-entropy credentials and account lockout policies to prevent automated brute force attacks targeting exposed remote desktop protocol services. Tue, 01 Sep 2026 09:00:00 GMT One Control, Tested rdp brute-force account-lockout password-policy https://breachpath.org/notes/access-logging-with-alerting-on-bulk-reads https://breachpath.org/notes/access-logging-with-alerting-on-bulk-reads This control detects bulk data exfiltration by flagging anomalous read volumes in cloud storage and databases via high-severity alerts within the SIEM system. Fri, 28 Aug 2026 09:00:00 GMT One Control, Tested cloud-storage data-exfiltration anomaly-detection siem https://breachpath.org/notes/ability-to-break-federation-and-force-re-authentication-quickly https://breachpath.org/notes/ability-to-break-federation-and-force-re-authentication-quickly This control revokes active sessions across federated service providers to stop a compromised identity from maintaining persistence via hijacked tokens. Tue, 25 Aug 2026 09:00:00 GMT One Control, Tested session-revocation federation identity-provider saas-security https://breachpath.org/notes/a-culture-where-staff-can-question-unusual-executive-requests https://breachpath.org/notes/a-culture-where-staff-can-question-unusual-executive-requests This control mandates out-of-band verification to stop CEO fraud and business email compromise by requiring a second channel for all urgent payment requests. Fri, 21 Aug 2026 09:00:00 GMT One Control, Tested ceo-fraud bec social-engineering out-of-band impersonation https://breachpath.org/notes/least-privilege-and-credential-theft-protections https://breachpath.org/notes/least-privilege-and-credential-theft-protections This security control limits lateral movement by blocking workstation RDP, preventing credential dumping from memory, and enforcing strict least privilege. Tue, 18 Aug 2026 09:00:00 GMT One Control, Tested lateral-movement endpoint-hardening rdp least-privilege credential-dumping https://breachpath.org/notes/immutable-offline-backups-tested-for-restore https://breachpath.org/notes/immutable-offline-backups-tested-for-restore Implement immutable, offline backups to prevent ransomware from deleting recovery points, ensuring critical business data remains recoverable after an attack. Tue, 18 Aug 2026 09:00:00 GMT One Control, Tested ransomware-protection immutable-backups disaster-recovery data-integrity https://breachpath.org/attack-paths/supplier-software-update-to-ransomware https://breachpath.org/attack-paths/supplier-software-update-to-ransomware A trusted software update from a compromised supplier delivers attacker code into the environment, which is used to establish control and deploy ransomware from the inside. manufacturing healthcare retail financial-services professional-services ransomware https://breachpath.org/attack-paths/healthcare-portal-to-patient-data https://breachpath.org/attack-paths/healthcare-portal-to-patient-data A weakness in a patient-facing portal or its integration is used to move from a single account's view to broad access to clinical records held in connected systems. healthcare data-theft https://breachpath.org/attack-paths/identity-provider-compromise-to-federated-access https://breachpath.org/attack-paths/identity-provider-compromise-to-federated-access An attacker who reaches the single sign-on identity provider abuses its trust to grant themselves access across every federated application at once — turning one identity system into keys to the whole estate. saas financial-services professional-services manufacturing account-takeover data-theft https://breachpath.org/attack-paths/saas-api-token-to-data-theft https://breachpath.org/attack-paths/saas-api-token-to-data-theft A leaked API token for a business SaaS platform is used to access its API directly, enumerate what the token can reach, and export data at scale — bypassing the login and its MFA entirely. saas professional-services financial-services retail data-theft https://breachpath.org/attack-paths/web-skimming-to-payment-fraud https://breachpath.org/attack-paths/web-skimming-to-payment-fraud A weakness in an e-commerce site or one of its third-party scripts is used to capture customers' payment details at checkout, which are then used or sold for fraud. retail charity saas invoice-fraud data-theft https://breachpath.org/attack-paths/exposed-rdp-to-ransomware https://breachpath.org/attack-paths/exposed-rdp-to-ransomware An internet-exposed remote desktop service with weak authentication gives direct interactive access to a host, which is used to spread, escalate and deploy ransomware. manufacturing retail healthcare professional-services charity ransomware https://breachpath.org/attack-paths/phishing-to-executive-communications https://breachpath.org/attack-paths/phishing-to-executive-communications A targeted lure compromises an executive or assistant mailbox, which is quietly monitored to harvest sensitive correspondence and impersonate leadership for further reach. legal financial-services professional-services manufacturing account-takeover data-theft https://breachpath.org/attack-paths/azure-managed-identity-to-subscription-control https://breachpath.org/attack-paths/azure-managed-identity-to-subscription-control A compromised Azure workload is used to assume its managed identity, whose over-broad role assignments are escalated toward control of the subscription and the data it holds. saas financial-services manufacturing professional-services data-theft account-takeover https://breachpath.org/attack-paths/mfa-fatigue-to-microsoft-365-takeover https://breachpath.org/attack-paths/mfa-fatigue-to-microsoft-365-takeover With a valid password in hand, an attacker wears the user down with repeated approval prompts, registers their own authenticator for durable access, and takes over the Microsoft 365 account. saas professional-services financial-services retail charity account-takeover https://breachpath.org/attack-paths/stolen-credentials-to-domain-admin https://breachpath.org/attack-paths/stolen-credentials-to-domain-admin A single reused password gets a foothold in Active Directory, which is turned — through service-account weaknesses and credential reuse — into full domain-administrator control. professional-services manufacturing financial-services legal healthcare account-takeover https://breachpath.org/attack-paths/vulnerable-web-application-to-ransomware https://breachpath.org/attack-paths/vulnerable-web-application-to-ransomware A flaw in an internet-facing application provides a server foothold, which is used to move onto the internal network, escalate privilege and deploy ransomware against reachable systems. retail manufacturing healthcare professional-services ransomware https://breachpath.org/attack-paths/google-workspace-account-to-data-theft https://breachpath.org/attack-paths/google-workspace-account-to-data-theft A phished Google Workspace identity is turned into durable access through a third-party app grant, then used to search Drive and Gmail for sensitive material and export it. saas charity professional-services retail data-theft account-takeover https://breachpath.org/attack-paths/saas-administrator-compromise https://breachpath.org/attack-paths/saas-administrator-compromise A phished SaaS administrator identity is used to weaken tenant security settings, establish persistence via integrations, and access or export the customer and business data the platform holds. saas professional-services retail charity financial-services account-takeover data-theft https://breachpath.org/attack-paths/supplier-account-to-internal-network https://breachpath.org/attack-paths/supplier-account-to-internal-network A compromised supplier's access is used to enter the organisation through a trusted connection, then to move from the supplier's limited footprint toward internal systems and data. manufacturing retail healthcare financial-services professional-services data-theft ransomware https://breachpath.org/attack-paths/business-email-compromise-to-invoice-fraud https://breachpath.org/attack-paths/business-email-compromise-to-invoice-fraud A compromised finance or executive mailbox is used to study payment processes, establish stealthy persistence, and redirect a legitimate payment to an attacker-controlled account. professional-services legal manufacturing charity retail invoice-fraud https://breachpath.org/attack-paths/aws-access-key-to-data-exfiltration https://breachpath.org/attack-paths/aws-access-key-to-data-exfiltration A leaked long-lived AWS access key is used to enumerate the account, escalate through permissive IAM, and read and exfiltrate data from cloud storage and databases. saas retail financial-services healthcare data-theft https://breachpath.org/attack-paths/source-control-token-to-production https://breachpath.org/attack-paths/source-control-token-to-production A leaked source-control token grants access to private repositories, where hardcoded secrets and CI/CD trust are used to reach and exfiltrate from the production environment and its source code. saas financial-services manufacturing ip-theft data-theft https://breachpath.org/attack-paths/entra-id-guest-to-privileged-access https://breachpath.org/attack-paths/entra-id-guest-to-privileged-access An over-permissioned external guest identity is used to enumerate the tenant, abuse excessive directory rights and escalate toward privileged roles and the resources they unlock. saas professional-services financial-services legal account-takeover data-theft https://breachpath.org/attack-paths/exposed-vpn-to-active-directory-ransomware https://breachpath.org/attack-paths/exposed-vpn-to-active-directory-ransomware Weakly protected remote access is used to reach the internal network, escalate to domain-wide control of Active Directory, neutralise backups and stage ransomware across the estate. manufacturing healthcare retail professional-services financial-services ransomware https://breachpath.org/attack-paths/web-application-flaw-to-cloud-credentials https://breachpath.org/attack-paths/web-application-flaw-to-cloud-credentials A flaw in an internet-facing custom application is used to reach the workload's identity, harvest cloud credentials, and pivot into the wider cloud account where production data lives. saas retail financial-services manufacturing professional-services data-theft ip-theft https://breachpath.org/attack-paths/microsoft-365-account-to-sensitive-data https://breachpath.org/attack-paths/microsoft-365-account-to-sensitive-data A phished Microsoft 365 identity is turned into durable access, used to discover where sensitive data lives in SharePoint and Teams, and finally to quietly extract it — all without dropping malware. legal financial-services professional-services healthcare saas data-theft account-takeover