Fixing One Hole at a Time Is No Longer Enough: Why Security Must Follow the Full Attack Path
Criminals no longer stop at the front door. They chain weaknesses across apps, accounts, and cloud systems, and security teams testing each piece in isolation are missing the bigger picture.
Key points
- Modern attackers string together weaknesses across web applications, identity systems, and cloud environments rather than exploiting a single flaw.
- The window between a vulnerability going public and criminals exploiting it keeps shrinking, leaving defenders less time to react.
- Security teams organised by technology type tend to test in silos, which doesn't reflect how real attacks unfold.
- Horizon3.ai launched NodeZero WebApp in 2025 to validate end-to-end attack routes starting from web applications.
- Patching a vulnerability doesn't prove the danger is gone; teams now want evidence the full attack path is actually broken.
Why testing one system at a time leaves gaps
Most organisations split security work by technology: one team checks apps, another manages staff logins, a third reviews cloud storage. Each does its job well. Attackers don't respect those boundaries.
A weakness in a customer-facing website can expose credentials. Stolen credentials let criminals impersonate legitimate staff. From there, they can reach cloud systems holding sensitive business data. No single team sees that full journey unless they're testing it end to end. We looked at a related gap in federal patch policy in our 29 July story on the US government's new remediation directive, which found that even deadline-driven patching doesn't close exploitable paths when AI is accelerating the attack side.
What changes when defenders think like attackers?
Stop asking only "does a flaw exist?" Start asking "can a criminal actually use this flaw to cause real damage?"
A software vulnerability may score a frightening CVSS (Common Vulnerability Scoring System) number on paper yet sit behind controls that make it practically unreachable. A lower-rated flaw could be the first link in a chain that leads straight to customer records. Knowing which is which is the whole game.
This thinking underpins CTEM, short for Continuous Threat Exposure Management, a framework that pushes teams to test constantly, rank risks by real exploitability, and verify that a patch has closed the path rather than ticked a box.
The product angle: Horizon3.ai enters the picture
Earlier this year, Horizon3.ai extended its autonomous testing platform with NodeZero WebApp. The module simulates an attack starting at an internet-facing web application, then follows the chain automatically through identity systems and cloud environments, mapping the full route a criminal could take. We covered the company's $250 million funding round on 3 August, which sets useful context for why they're moving into this space now.
The claim, as reported by CSO Online from Horizon3.ai's own materials, is that teams get repeatable, concrete evidence of whether a given path is open or closed before a real attacker finds out.
| Layer tested | Why it matters to attackers |
|---|---|
| Web applications and APIs | Constant change creates fresh weaknesses |
| Identity and login systems | Stolen credentials open internal doors |
| Cloud infrastructure | Where sensitive data and critical systems live |
| Network endpoints | Lateral movement, meaning sideways spread |
What should ordinary people take from this?
When criminals break into a company by chaining small weaknesses, the end prize is usually customer data: names, email addresses, payment details, health records.
Watch for unexpected password-reset emails or login alerts from services you use. If a company announces a breach, change your password for that service immediately and change it on any other site where you reused it. A password manager, a tool that generates and stores unique passwords, removes most of that risk.
Common questions
Does patching software actually fix the problem?
Patching closes the specific hole, but it doesn't automatically prove the full attack chain is broken. Security teams now run follow-up tests to confirm criminals can no longer move through the environment after a patch is applied.
Why do criminals use multiple small weaknesses instead of one big one?
One big, easy flaw rarely exists in well-maintained systems. Chaining minor weaknesses together is often simpler, and it makes the attack harder to detect because each individual step looks almost normal.
