You Don't Need to Fire the Exploit to Know You're Exposed

Key points

• Security firm Picus is promoting a method called TTP chaining that tests whether an attack would succeed without actually running the exploit code.
• The approach targets situations where launching a real exploit is impossible or too dangerous, such as against hospital systems or industrial controllers.
• TTP stands for tactics and techniques: the individual steps an attacker takes from first foothold to final goal.
• Confirming each step in the chain works in your environment lets a team infer that the full attack would too.
• The method addresses a long-standing gap where teams patch based on severity scores alone, without knowing whether the flaw is truly reachable in their setup.

A new vulnerability lands. The vendor rates it critical. Nobody on the team can tell you whether it matters for your network, because running the real exploit against production is out of the question.

That's the gap Picus, a security validation vendor, says it can close with a technique called TTP chaining. The pitch was covered this week by BleepingComputer.

What is TTP chaining, in plain English?

TTP stands for tactics and techniques: the sequence of steps an attacker takes to break in and get what they want. Think of a burglary. Pick the lock, disable the alarm, find the safe, crack it, leave. Each step is a technique. Together they form a chain.

An exploit is the loud, dangerous part: the actual code that abuses a software flaw. Running it on a live system can crash the system or corrupt data. On a hospital imaging server or a factory floor controller, that's not acceptable.

Picus argues you often don't need to fire the exploit at all. Confirm that every other step in the attacker's chain works, the setup, the lateral movement, the privilege escalation, and you already know the exploit would land if launched. If any single link in that chain fails in your environment, the exploit is effectively neutered even if the underlying flaw is unpatched.

Why this matters beyond the marketing

Most organisations still triage vulnerabilities using CVSS scores, the 0-to-10 severity ratings assigned to each published flaw. A top score sounds terrifying. But the same score applied to a flaw that requires an attacker to already be past your internal firewalls and a jump host is a very different problem from one exposed directly to the public internet.

TTP chaining is one way to bring that context in without the risk of live exploitation. It sits alongside older ideas like breach and attack simulation, which quietly mimics attacker behaviour to see what defences catch it and what they don't. Our 10 July story on security debt growing faster than companies can fix it made a related point: knowing what's reachable matters more than the raw count of unresolved flaws.

The honest caveat: this is a vendor telling you their approach is the answer. It isn't a replacement for patching. A flaw you can't currently reach may become reachable after a firewall change or a phished helpdesk account. The quality of any TTP chain assessment is only as good as the technique library behind it, and how current that library is with real attacker behaviour.

Should you worry?

If you run a small business or sit on a board, the practical point is simple. Ask your security team not just "are we patched?" but "which unpatched issues could an attacker actually reach from outside?" Those are different questions, and the second is usually the more useful one.

For everyone else, the story is a reminder that a scary vulnerability headline doesn't automatically mean your bank or your employer is about to fall over. Reachability matters. Context matters. The tools to measure both are getting sharper, but they're still only as reliable as the vendor keeping them up to date. That's the part worth watching.