Attack Path

A Cortex Cloud demonstration · prioritize by context, not severity Turn 0

Move with ↑↓←→ or WASD. The world only moves when you move.

The board

Ops — your security team

You. Reach the asset, clear real threats.

Database — high-value asset

The crown jewel you must protect.

Misconfiguration — CSPM

Internet-exposed config flaw. The real entry point.

Unpatched Host — CWPP

Lets the attacker move laterally toward the asset.

Container Vuln — CWPP

Critical by severity — but no path to the asset.

Presenter talk track

What this illustrates (technical)

Cortex Cloud unifies CSPM (how it's configured — RedLock/Evident heritage) with CWPP (how it's running — Twistlock heritage) in one data lake.

Attack Path Analysis correlates exposure + reachability + impact to find the chain an attacker would actually walk — so you fix the one issue that breaks the path, instead of triaging by raw severity.

Level 1 = severity-only triage: you fix the loudest alert and miss the real path. Level 2 = the path is mapped before the attacker moves; the "critical" container is deprioritized because it isn't reachable.