Implementing an attack path management program requires a structured and progressive approach. This operational roadmap guides the organization through a 90-day journey, divided into concrete phases with activities, deliverables, and measurable KPIs to ensure the program’s success.

Initial baseline: assessing the starting point

Before launching the program, it is essential to establish a clear baseline of the current security state. This preliminary phase involves a complete inventory of critical assets, mapping of privileged access, and documentation of existing security controls. A structured Risk Assessment allows for the identification of priority areas and the definition of program objectives.

Baseline deliverables: critical asset inventory, privileged access map, list of existing controls, and current security status report.

Phase 1 (0-30 days): discovery and initial mapping

During the first 30 days, the main objective is asset discovery and mapping the most critical attack paths. This phase requires integration with existing vulnerability management systems and the construction of the initial graph of relationships between assets, identities, and permissions. Leveraging a managed vulnerability management service helps accelerate discovery and maintain a continuous flow of data on detected exposures.

Main activities:

• Deployment of discovery tools and integration with existing infrastructure
• Mapping of relationships between assets, identities, and permissions
• Identification of attack paths toward critical assets
• Integration with vulnerability databases and threat intelligence

Deliverables: initial attack path graph, list of priority chokepoints, completed integration with vulnerability databases, and discovery report.

Phase KPIs: percentage of mapped assets (target: 80%), number of identified critical paths, average discovery time per asset.

Phase 2 (30-60 days): prioritization and remediation

From day 30 to day 60, the focus shifts to defining strategic chokepoints and prioritizing remediation activities. This phase requires collaboration between security, IT, and business teams to align priorities with actual risk.

Main activities:

• Analysis of chokepoints and evaluation of remediation impact
• Development of remediation playbooks for common scenarios
• Integration with existing ticketing and workflow systems
• Initiation of the first remediation activities on the most critical paths

Deliverables: documented remediation playbooks, integration with ticketing systems, prioritization dashboards, and board reports with risk evidence.

Phase KPIs: number of identified chokepoints, percentage of critical paths in remediation (target: 40%), average remediation time per risk category.

Phase 3 (60-90 days): integration and automation

In the final 30 days, the program is stably integrated into the organization’s security processes. The goal is to automate detection, prioritization, and remediation workflows, ensuring a continuous exposure management process.

Main activities:

• Automation of detection and alerting workflows
• Integration with SOAR, SIEM, and other security operations tools
• Definition of risk-based remediation SLAs
• Implementation of executive dashboards for the board

Deliverables: operational automated workflows, completed integration with Continuous Security Testing, KPI dashboards for the board, and process documentation.

Phase KPIs: percentage of automated workflows (target: 70%), reduction in remediation time compared to the baseline, continuous coverage of critical assets (target: 95%).

Metrics for the board and stakeholders

The program’s success is measured through concrete and understandable metrics for the board. Key metrics include:

• Exposure reduction: number of critical paths closed compared to the baseline
• Operational efficiency: average remediation time per risk category
• Coverage: percentage of critical assets continuously monitored
• Improvement trends: evolution of exposure over time

These metrics should be included in periodic reports coordinated with the board and compliance stakeholders, demonstrating the tangible value of the attack path management program. For more information on how to structure cyber KPIs for the board and strategic risk metrics, a dedicated analysis is available.

Strategic and operational support

Implementing an attack path management program requires specialized expertise and continuous support. A Virtual CISO service can guide the overall strategy, while operational support ensures the effective execution of daily activities.

To learn more about the strategic benefits of the program, consult the benefits of attack path management and our strategic deep dive. Choosing the right tools is fundamental: our selection criteria help identify the solutions best suited to your organizational context.

FAQ and quick answers

• What deliverables should be produced in 90 days?
• Complete asset inventory, attack path graph, documented remediation playbooks, automated workflows, and KPI dashboards for the board with exposure and remediation metrics.
• How to align the roadmap with security services?
• Combine a Virtual CISO for strategic governance, Risk Assessment for the initial baseline, and Continuous Security Testing for ongoing monitoring of attack paths.
• What metrics should be included in board reports?
• Report the number of closed critical paths, average remediation time per category, percentage of covered critical assets, and trends in exposure reduction over time.