What it does. Deploys XM Cyber's continuous exposure management platform to build Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-attack-path-analysis-with-xm-cyber, or copy the skill folder into ~/.claude/skills/implementing-attack-path-analysis-with-xm-cyber/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-attack-path-analysis-with-xm-cyber/SKILL.md

SKILL.md (verbatim)

name: implementing-attack-path-analysis-with-xm-cyber
description: Deploys XM Cyber's continuous exposure management platform to build
  attack graphs that chain vulnerabilities, misconfigurations, identity risks, and
  credential weaknesses toward critical assets, identifying the small fraction of
  exposures sitting on converging "choke points". Use when mapping attack paths
  across an environment or prioritizing remediation within a continuous threat exposure
  management (CTEM) program.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- xm-cyber
- attack-path-analysis
- exposure-management
- ctem
- choke-points
- breach-simulation
- attack-surface
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068

Implementing Attack Path Analysis with XM Cyber

Overview

XM Cyber is a continuous exposure management platform that uses attack graph analysis to identify how adversaries can chain together exposures -- vulnerabilities, misconfigurations, identity risks, and credential weaknesses -- to reach critical business assets. According to XM Cyber's 2024 research analyzing over 40 million exposures across 11.5 million entities, organizations typically have around 15,000 exploitable exposures, but traditional CVEs account for less than 1% of total exposures. The platform identifies that only 2% of exposures reside on "choke points" of converging attack paths, enabling security teams to focus on fixes that eliminate the most risk with the least effort.

When to Use

• When deploying or configuring implementing attack path analysis with xm cyber capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• XM Cyber platform license and tenant access
• Network connectivity to monitored environments (on-premises, cloud, hybrid)
• Administrative access for agent deployment or agentless integration
• Cloud provider API access (AWS, Azure, GCP) for cloud attack path analysis
• Active Directory read access for identity-based attack path modeling
• CMDB or asset inventory defining critical business assets

Core Concepts

Attack Graph Analysis

Unlike point-in-time vulnerability scanning, XM Cyber continuously models all possible attack paths across the entire environment:

Traditional Scanning	XM Cyber Attack Path Analysis
Lists individual vulnerabilities	Maps chained attack paths
Scores by CVSS severity	Scores by reachability to critical assets
Point-in-time assessment	Continuous real-time modeling
No context of lateral movement	Models full lateral movement chains
Treats each vuln independently	Shows how vulns chain together

Key Metrics from XM Cyber Research (2024)

Finding	Statistic
Average exposures per organization	~15,000
CVE-based exposures	< 1% of total
Misconfiguration-based exposures	~80% of total
Exposures on critical choke points	2%
Orgs where attackers can pivot on-prem to cloud	70%
Cloud critical assets compromisable in 2 hops	93%
Critical asset exposures in cloud platforms	56%

Choke Point Concept

A choke point is a single entity (host, identity, credential, misconfiguration) that sits at the intersection of multiple attack paths leading to critical assets. Fixing a choke point eliminates many attack paths simultaneously, providing maximum risk reduction per remediation effort.

Attack Path 1:  Web Server -> SQL Injection -> DB Admin Creds
                                                    \
Attack Path 2:  VPN -> Stolen Creds -> File Server   -> Domain Controller
                                                    /     (Critical Asset)
Attack Path 3:  Workstation -> Mimikatz -> Cached Creds
                                    ^
                              CHOKE POINT
                     (Cached Domain Admin credential)

Exposure Categories

Category	% of Exposures	Examples
Identity & Credentials	40%	Cached credentials, over-privileged accounts, Kerberoastable SPNs
Misconfigurations	38%	Open shares, weak permissions, missing hardening
Network Exposures	12%	Open ports, flat networks, missing segmentation
Software Vulnerabilities	8%	Unpatched CVEs, outdated software
Cloud Exposures	2%	IAM misconfig, public storage, overly permissive roles

Workflow

Step 1: Define Critical Assets (Business Context)

Critical Asset Definition:
    Tier 1 - Crown Jewels:
        - Domain Controllers (Active Directory)
        - Database servers with PII/financial data
        - ERP systems (SAP, Oracle)
        - Certificate Authority servers
        - Backup infrastructure (Veeam, Commvault)

    Tier 2 - High Value:
        - Email servers (Exchange)
        - File servers with IP/trade secrets
        - CI/CD pipeline servers
        - Jump servers / PAM vaults

    Tier 3 - Supporting Infrastructure:
        - DNS/DHCP servers
        - Monitoring systems
        - Logging infrastructure

Step 2: Deploy XM Cyber Sensors

Deployment Architecture:
    On-Premises:
        - Install XM Cyber sensor on management server
        - Configure AD integration (read-only service account)
        - Enable network discovery protocols
        - Set scanning scope (IP ranges, AD OUs)

    Cloud (AWS):
        - Deploy XM Cyber CloudConnect via CloudFormation
        - Configure IAM role with read-only permissions
        - Enable cross-account scanning for multi-account orgs

    Cloud (Azure):
        - Deploy via Azure Marketplace
        - Configure Entra ID (Azure AD) integration
        - Grant Reader role on subscriptions

    Hybrid:
        - Configure cross-environment path analysis
        - Map on-premises to cloud trust relationships
        - Enable identity correlation across environments

Step 3: Configure Attack Scenarios

Scenario 1: External Attacker to Domain Admin
    Starting Point:  Internet-facing assets
    Target:          Domain Admin privileges
    Attack Techniques: Exploit public CVEs, credential theft,
                      lateral movement, privilege escalation

Scenario 2: Insider Threat to Financial Data
    Starting Point:  Any corporate workstation
    Target:          Financial database servers
    Attack Techniques: Credential harvesting, share enumeration,
                      privilege escalation, data access

Scenario 3: Cloud Account Takeover
    Starting Point:  Compromised cloud IAM user
    Target:          Production cloud infrastructure
    Attack Techniques: IAM privilege escalation, cross-account
                      pivot, storage access, compute compromise

Scenario 4: Ransomware Propagation
    Starting Point:  Phished workstation
    Target:          Maximum host compromise (lateral spread)
    Attack Techniques: Credential reuse, SMB exploitation,
                      PsExec/WMI lateral movement

Step 4: Analyze Attack Path Results

# Interpreting XM Cyber attack path analysis results
def analyze_choke_points(attack_graph_results):
    """Analyze attack graph results for priority remediation."""

    choke_points = []
    for entity in attack_graph_results.get("entities", []):
        if entity.get("is_choke_point"):
            choke_points.append({
                "entity_name": entity["name"],
                "entity_type": entity["type"],
                "attack_paths_blocked": entity["paths_through"],
                "critical_assets_protected": entity["protects_assets"],
                "remediation_complexity": entity["fix_complexity"],
                "exposure_type": entity["exposure_category"],
            })

    # Sort by impact (paths blocked * assets protected)
    choke_points.sort(
        key=lambda x: x["attack_paths_blocked"] * len(x["critical_assets_protected"]),
        reverse=True
    )

    print(f"Total choke points identified: {len(choke_points)}")
    print(f"\nTop 10 choke points for maximum risk reduction:")
    for i, cp in enumerate(choke_points[:10], 1):
        print(f"  {i}. {cp['entity_name']} ({cp['entity_type']})")
        print(f"     Paths blocked: {cp['attack_paths_blocked']}")
        print(f"     Assets protected: {len(cp['critical_assets_protected'])}")
        print(f"     Exposure type: {cp['exposure_type']}")
        print(f"     Fix complexity: {cp['remediation_complexity']}")

    return choke_points

Step 5: Prioritize Remediation by Impact

Remediation Priority Matrix:

Priority 1 (Immediate - 48h):
    - Choke points on paths to Tier 1 assets
    - Identity exposures (cached Domain Admin creds)
    - Internet-facing vulnerabilities with attack paths

Priority 2 (Urgent - 7 days):
    - Choke points on paths to Tier 2 assets
    - Cloud IAM misconfigurations with privilege escalation
    - Network segmentation gaps enabling lateral movement

Priority 3 (Important - 30 days):
    - Remaining choke points
    - Misconfigurations reducing defense depth
    - Non-critical software vulnerabilities on attack paths

Priority 4 (Standard - 90 days):
    - Exposures NOT on any attack path to critical assets
    - Informational findings
    - Hardening recommendations

Best Practices

1. Define critical assets before deploying the platform; attack paths without target context are meaningless
2. Focus remediation on choke points first; fixing 2% of exposures can eliminate the majority of risk
3. Use attack path context to justify remediation urgency to IT teams (show the chain, not just the vuln)
4. Re-run attack path analysis after each remediation to verify paths are truly eliminated
5. Include cloud environments in analysis; 56% of critical asset exposures exist in cloud platforms
6. Monitor for new attack paths created by infrastructure changes (new servers, permission changes)
7. Integrate findings with ticketing systems for automated remediation tracking

Common Pitfalls

• Focusing solely on CVEs when 80% of exposures come from misconfigurations
• Not defining critical assets, leading to unfocused attack path analysis
• Treating all exposures equally instead of focusing on choke points
• Ignoring identity-based attack paths (cached credentials, Kerberoastable accounts)
• Not correlating on-premises and cloud attack paths in hybrid environments
• Running analysis once instead of continuously

Related Skills

• implementing-continuous-security-validation-with-bas
• performing-asset-criticality-scoring-for-vulns
• detecting-lateral-movement-in-network
• exploiting-active-directory-with-bloodhound

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Attack Path Analysis Report Template

Analysis Summary

Field	Value
Report Date	[YYYY-MM-DD]
Environment Scope	[On-prem / Cloud / Hybrid]
Total Entities Analyzed	[N]
Total Attack Paths Found	[N]
Critical Assets Defined	[N]
Choke Points Identified	[N]

Exposure Distribution

Category	Count	%
Identity & Credentials	[N]	[%]
Misconfigurations	[N]	[%]
Network Exposures	[N]	[%]
Software Vulnerabilities	[N]	[%]
Cloud Exposures	[N]	[%]

Top Choke Points for Remediation

Rank	Entity	Type	Category	Paths Blocked	Assets Protected	Priority
1	[Name]	[Type]	[Category]	[N]	[N]	P1

Critical Asset Risk Summary

Asset	Tier	Attack Paths	Shortest Path	Status
[Asset]	[1-3]	[N]	[N hops]	[At Risk/Protected]

Remediation Progress

Priority	Total	Fixed	In Progress	Paths Eliminated
P1	[N]	[N]	[N]	[N]
P2	[N]	[N]	[N]	[N]

references/api-reference.md (verbatim)

API Reference: XM Cyber Attack Path Analysis Agent

Dependencies

Library	Version	Purpose
requests	>=2.28	HTTP client for XM Cyber REST API

CLI Usage

python scripts/agent.py \
  --url https://xmcyber.example.com \
  --api-key YOUR_API_KEY \
  --output-dir /reports/ \
  --output attack_path_report.json

Functions

XMCyberClient(base_url, api_key)

Client class with Bearer token auth for the XM Cyber API.

get_scenarios() -> list

GET /api/v1/scenarios - Lists all attack simulation scenarios.

get_attack_paths(scenario_id) -> list

GET /api/v1/scenarios/{id}/attack-paths - Returns attack paths for a scenario.

get_choke_points(scenario_id) -> list

GET /api/v1/scenarios/{id}/choke-points - Returns points where attack paths converge.

get_critical_assets() -> list

GET /api/v1/critical-assets - Lists defined critical business assets.

get_entities_at_risk(scenario_id) -> list

GET /api/v1/scenarios/{id}/entities-at-risk - Entities reachable via attack paths.

get_remediation_actions(scenario_id) -> list

GET /api/v1/scenarios/{id}/remediations - Prioritized fix recommendations.

analyze_choke_points(choke_points) -> dict

Ranks choke points by paths_through count, returns top 10.

compute_risk_score(attack_paths, critical_assets) -> dict

Calculates critical asset exposure percentage from reachable targets.

Output Schema

{
  "scenarios": [{
    "name": "Full Environment",
    "attack_paths": 1234,
    "choke_point_analysis": {"total_choke_points": 45, "top_choke_points": []},
    "risk_score": {"critical_asset_exposure_pct": 67.5}
  }]
}

references/standards.md (verbatim)

Standards and References - XM Cyber Attack Path Analysis

XM Cyber Resources

• XM Cyber Platform: https://xmcyber.com/
• 2024 State of Exposure Management Report: https://info.xmcyber.com/2024-state-of-exposure-management
• CTEM (Continuous Threat Exposure Management): https://xmcyber.com/ctem/
• XM Cyber EASM Integration: https://xmcyber.com/press-release/xm-cyber-unifies-external-discovery-with-internal-validation/

Industry Frameworks

• Gartner CTEM: Continuous Threat Exposure Management framework (2022)
• MITRE ATT&CK: Lateral movement and privilege escalation techniques
• NIST CSF 2.0: Identify, Protect, Detect functions
• CIS Controls v8.1 Control 7: Continuous Vulnerability Management

Research Findings (2024)

Metric	Finding
Avg exposures per org	~15,000
CVE-based exposures	< 1% of total
Misconfiguration exposures	~80%
Identity/credential exposures	~40%
Critical choke points	2% of all exposures
On-prem to cloud pivot	70% of organizations
Cloud assets compromised in 2 hops	93%

Related Technologies

• BloodHound/SharpHound: Active Directory attack path analysis
• PurpleKnight: AD security assessment
• CrowdStrike Falcon Exposure Management
• Tenable Identity Exposure
• Microsoft Defender for Identity

references/workflows.md (verbatim)

Workflows - XM Cyber Attack Path Analysis

Workflow 1: Continuous Exposure Management Lifecycle

┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│ Define Critical  │────>│ Deploy Sensors   │────>│ Run Attack Graph │
│ Assets (Crown    │     │ (On-prem + Cloud)│     │ Analysis         │
│ Jewels)          │     │                  │     │                  │
└──────────────────┘     └──────────────────┘     └──────────────────┘
                                                          │
        ┌────────────────────────────────────────────────┘
        v
┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
│ Identify Choke   │────>│ Prioritize       │────>│ Remediate &      │
│ Points           │     │ Remediation      │     │ Validate         │
└──────────────────┘     └──────────────────┘     └──────────────────┘
        │
        v
┌──────────────────┐
│ Continuous       │ (Loop back to Attack Graph Analysis)
│ Monitoring       │
└──────────────────┘

Workflow 2: Choke Point Remediation

For each identified choke point:
    1. Document the entity (host, credential, misconfiguration)
    2. Map all attack paths passing through this choke point
    3. List all critical assets protected if choke point is fixed
    4. Determine remediation action (patch, reconfig, credential rotation)
    5. Estimate fix complexity (easy/moderate/complex)
    6. Calculate risk reduction score (paths * assets / complexity)
    7. Assign to remediation team with priority and SLA
    8. After fix: re-run analysis to confirm path elimination
    9. Document residual risk if paths still exist

Workflow 3: Attack Path to Remediation Ticket

XM Cyber Finding:
    "Cached Domain Admin credential on WORKSTATION-042
     enables 47 attack paths to Domain Controller DC-01"
         │
         v
    Remediation Ticket:
        Priority: P1-Emergency
        Title: "Remove cached DA cred on WORKSTATION-042"
        Action: Clear credential cache, implement LAPS,
                restrict DA logon to Tier 0 only
        Impact: Eliminates 47 attack paths to DC-01
        SLA: 48 hours

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.