Every Path Counts: When Defenders Learn to Think in Graphs

No ratings

Presented at BSides Tallinn 2026 by

Jarkko Kinnunen

Last year, in Every Step Counts, I showed how to measure detection of individual attacker steps, one technique at a time. It's how most blue teams work: can I detect this; can I detect that. But real intrusions are not isolated steps. They are paths, and attackers walk them by chaining identities, privileges, and trust. This talk asks a more ambitious question: can we simulate how an adversary would move through an environment and predict the identity attack paths they would take across Active Directory and cloud before they take them? This is where graphs change the game. When you model an environment as a graph, identities, hosts, and privileges become nodes, and the permissions and trust relationships between them become edges. Attackers have always seen the world this way; this session is about defenders learning to see it too. We'll walk through how attack paths form, how to read them, and how to find the choke points where cutting a single edge collapses dozens of paths at once. From there we turn insight into action. You'll leave knowing how to map your own Active Directory and cloud estate, surface the paths hiding inside it, identify the few choke points that matter so you can fix less and prevent more, and prioritise remediation by real impact instead of working down an endless list of findings. Best of all, it's built on open tooling you can run yourself, so the whole approach travels home with you and works against the environment you already have.