Why we model your attack surface as a graph

Most security tooling hands you a list. Assets in one column, vulnerabilities in another, a severity badge to sort by. Lists are easy to build and easy to read, and that is precisely their problem: they flatten away the one dimension that decides whether you actually get breached.

Attacks don't happen to items in a list. They happen along connections between them.

The thing a list can't show

Picture three entries in a typical report. A public storage bucket, misconfigured: medium. An internal CI runner with broad permissions: low, it's internal. A staging subdomain most people forgot existed: informational.

Sorted by severity, these live far apart in the report, and none of them looks like an emergency. But there's an edge from the forgotten subdomain to the CI runner, and an edge from the runner to the bucket, and from the bucket to production data. Read as a list, this is three minor findings. Read as a graph, it's a route.

The severity of the individual nodes never told you the story. The edges did.

Nodes are more than servers

Once you commit to thinking in graphs, the interesting question becomes what counts as a node, and the answer is much broader than most tools allow. A node is anything an attacker can use as a foothold or a fact:

• Your domains and the subdomains you don't remember owning
• Internal services that were never supposed to face the network
• Cloud assets, storage, and the permissions wired between them
• Dependencies and the supply chain behind them
• Public knowledge about you: a credential in an old commit, a detail a founder mentioned in a forum thread

That last category surprises people, but it's just honest about how real intrusions start. Attackers use everything reachable. So the map has to contain everything reachable.

Edges have to be earned

A graph is only useful if its edges are true. It's easy to draw a line between two nodes and assume a path exists; it's much harder, and far more valuable, to confirm it does. So every edge in the Arcsec graph is something we've tried to validate rather than something we've guessed at. An edge that survives that test is a path a real adversary could take. An edge that fails it gets pruned, and stops wasting your attention.

That distinction, between an assumed connection and a proven one, is the whole game. It's the difference between a report full of maybes and a map you can act on.

Keep exploring

A graph is never finished, because your surface never holds still. Every deploy adds nodes. Every integration adds edges. Every forgotten thing is a node someone else might find first. So the graph doesn't get built once and filed. It keeps exploring, keeps testing its own edges, and keeps redrawing itself as you change.

We think this is simply the honest shape of the problem. Your systems are a graph whether you model them as one or not. The only choice is whether you're looking at it, or the attacker is.