# Attack Paths

> How WhisperGraph models an external attack path: the chain that composes one, the shared node that becomes a choke point, blast radius, and where an infrastructure finding stops.

*Source: https://www.whisper.security/docs/recipes/attack-paths*

---
These recipes take you from one flagged indicator to the infrastructure it shares with everything around it, and from a shared node to the choke point worth acting on. An external attack path is the chain of internet infrastructure that connects an attacker to a target: the lookalike domain, the address it resolves to, the prefix announcing that address, the network routing it, the data centre, the cable underneath. Each link is an edge in the graph, so the whole route is one traversal, and every edge is an observation about infrastructure — the graph shows you the chain, not who walked it.

**Key concepts:** [Attack path analysis](/glossary/attack-path-analysis) · [Choke point analysis](/glossary/choke-point-analysis) · [Infrastructure pivoting](/glossary/infrastructure-pivoting).

## What a path is made of {#anatomy}

A path crosses layers that are already joined: naming and DNS, email, registration, routing, addressing, threat intelligence, and the physical estate. Each hop is a typed edge, named with its direction by [Connection Types](/docs/whisper-graph/schema/connections).

## The hidden link is a shared node {#shared-infrastructure}

Two indicators that look unrelated connect the moment you find the infrastructure they share. A shared address, a shared nameserver, a shared registration contact: each is one hop, and the hop that returns a row is the finding.

That row is a record, not an intent. A lookalike and the brand it imitates can share a registration contact because the brand registered its own typosquats, or because an adversary registered both; shared hosting and managed DNS put unrelated parties on one node by design. The pivot says where to look next, not which case you are in.

## The choke point is the payoff {#choke-point}

A choke point is the shared node that, severed, collapses the most paths: an address, a prefix, a network or a registrant you can block, sinkhole or report, where one action does the work of many. DNS usually makes a better one, because a nameserver answers for a whole estate.

Act on a choke point only when you can say why. [`explain()`](/docs/whisper-graph/procedures/explain) returns a scored, feed-by-feed verdict for an indicator, so the node arrives with a defensible reason rather than a bare number.

> **Read `coverage` before `band`.** Only `known-clean` licenses the word "clean"; `no-data` means
> *unknown*, which is a different thing again; `malicious-evidenced` and `ambiguous` mean there is
> evidence, whatever the band says. `whisper.explain` does not return `coverage` at all.
> Full contract: [Coverage — what we looked at](/docs/whisper-graph/procedures/coverage).

![Blast radius from one flagged address: the co-hosted domains, the feeds, the routing network.](/images/docs/whisper-blast-radius.svg)

## Blast radius is the same question inverted {#blast-radius}

The choke-point question is *what can reach this node*. Inverted it becomes *what depends on it*: fan out along dependency edges only, and the result is an availability map, not a threat assessment. The dependent with one provider, not the asset, is where an outage becomes an incident.

## Reading a path correctly {#reading-a-path}

A route is an infrastructure finding, never an identification. The ATT&CK layer is a curated reference plane built from public reporting: it names the techniques an actor is documented to use, and no traversal joins an actor to infrastructure. Zero rows is not a finding either — a refused query comes back as an error with its reason, so zero rows means wrong labels or no observation, and an absence is not a clean verdict.

## Related pages {#related}

- [Tracing a Path](/docs/recipes/tracing-a-path) — these ideas as five runnable steps.
- [Attack-Surface Mapper](/use-cases/attack-surface-recon/attack-surface) and [Supply-Chain Dependency Mapping](/use-cases/infrastructure-supply-chain/supply-chain) — the guided versions of these two halves.
- [Campaign Pivoting](/docs/recipes/threat-intel) — one indicator, the whole campaign.