Attack-path mapping

When it applies

You have several footholds/findings and need to see how they combine into a route to the objective — or you're defending and want to know which single edge, if cut, breaks the most paths.

Why it works

Attackers think in graphs; defenders who do too find the choke points. Modelling principals → permissions → resources as edges makes "can A reach D?" a reachability query, and surfaces multi-step paths no single finding reveals (this is why BloodHound changed AD assessment).