Following an Attack Path Backward

July 21, 2026 · InfraScout Team

A vulnerability list tells you what is weak. It does not tell you what that weakness reaches, and that is usually the question that decides what gets fixed this week.

Microsoft Security Exposure Management holds the answer as a graph: your assets as nodes, the relationships between them as edges, and your critical assets marked as such. Two new read-only tools read that graph and hand back attack paths and asset neighborhoods as things you can read rather than as query results.

Start at what you are protecting

The tool walks the graph backward from a target. You name what matters — a specific asset, or your critical-asset set as a whole — and it finds what can reach it.

That direction is deliberate. Walking forward from every possible entry point answers "where could this identity get to", which is an interesting question with an enormous answer. Walking backward from a critical asset answers "what stands between an attacker and this", which is a question with an actionable answer and a natural place to start fixing.

A path comes back as an ordered sequence with the relationship spelled out at each hop, so it reads as a sentence: this identity can authenticate to this host, which has a role on this critical asset. You can narrow to a class of starting point — identities rather than devices — or trace one relationship type through the graph.

Everything the graph makes awkward is handled before the result reaches you. The schema is hidden. The query language is hidden. And the criticality scale, which is inverted so that zero means most critical, comes back as a decoded label rather than as a number that means the opposite of what it looks like.

One thing to know about depth

A call returns paths of exactly the hop count you asked for, not every path up to it.

Search at depth three and a one-hop direct edge will not appear in the results. That is not an oversight — it is what makes the query complete in a usable amount of time. The obvious formulation, asking the graph to match every path up to a depth, times out at real tenant scale; we tried it. An exact-depth reverse traversal does not.

So the practical approach is to start at one hop and work outward. That also happens to be the right order for the answer: a direct edge to a critical asset is both the shortest path and usually the first thing to remove.

Truncation is always signaled, never silent. Where more target nodes or more paths existed than were returned, the response says so — a partial graph walk should never be read as an exhaustive one.

Then pivot into an asset

A path names assets, and the next question is invariably about one of them. The second tool takes a single asset and returns its one-hop neighborhood: its label, categories, and decoded criticality, plus the relationships pointing at it, leading from it, or both.

That is the follow-up move — a path told you this host sits between an entry point and something critical, and now you want to know what else touches it, and what it in turn touches.

What you need

Microsoft Security Exposure Management onboarding, and the Advanced Hunting permission your tenant most likely already has — these tools run through the same seam the existing hunting tools use, so no new consent is required. Without MSEM onboarding the exposure graph is unavailable and the tools say so plainly rather than returning an empty result you might mistake for a clean one.

Both tools are read-only and need no agent on any host.

Try it

Ask the AI "what can reach our critical assets in one hop?", then widen to two. When a path names a host you did not expect, ask about that host directly and see what else connects to it.

Full reference in Microsoft Cloud — Security Tools. For the Vulnerability Management and Defender for Identity tools that landed in the same batch, see Sensor Coverage, Phishing Results, and What's Worth Patching First. Questions? info@infrascout.cloud.