r/AskNetsec • u/Available_Chair_9451 • 5d ago

Analysis Cloud attack path analysis

I'm looking at options for Cloud Attack Path Analysis solutions and am wondering what solutions are decent vs. total snake oil. Orca keeps coming up but I'd really wanna hear from people actually running it than from a sales deck. I'm going to speak to several but would like to know if anyone out there has had particularly good or bad experiences with any of them. Feel free to DM if you don't want to speak openly in public; I understand 😁

12 Upvotes

89% Upvoted

6 comments sorted by

4

u/GloomyPresent3137 5d ago

orca does a lot of noise about graph db stuff but half the paths it flagged for us were just theoretical nonsense that nobody would actually traverse, like a vuln scanner on a box that had zero network access to anything interesting

wiz is more practical but the pricing is absolutely absurd for what you get, we ended up just mapping it ourselves with our existing tools and saved a pile of cash

2

u/Duchet_Odinaka51 5d ago

pricing in this space has completely lost touch with reality lately tbh.

1

u/Swimming_dasa 5d ago

one thing i would compare is how well each platform accounts for IAM permissions, network exposure and privilege escalation together. isolated misconfiguration alerts dont always reveal the actual attack path.

1

u/BetInformal6081 5d ago

one thing i would compare closely is how well each platform connects iam permissions network exposure and privilege escalation seeing those relationships together is where attack path analysis becomes useful..

1

u/V_Trautwein 4d ago edited 4d ago

the theoretical path problem is the real test here. orca flags stuff that looks scary on a graph but nobody could actually reach. when we evaluated orca, wiz and upwind, the runtime context was the difference, it only surfaced paths that were actually traversable in our env instead of hypothetical ones.