Attack Path Mapping Lab: Find Your Crown Jewels
Attack path analysis starts with a plain question: if an intruder lands on one laptop, what is the shortest realistic route to the things you cannot lose? In this lab you map those paths on a small invented network, find the management-plane systems with the most leverage and decide which boundaries to test first.
Pair it with the Network Isolation Decision Aid and the Identity Blast Radius Estimator. The scenario is fictional and has no exploit steps.
You are Priya Raman, security architect at Larchfield Freight, a freight and logistics company. The board has asked where an intruder who lands on one laptop could do the most damage, and which network boundaries to test first. Over 11 scored decisions you pick the crown jewels, map the shortest realistic paths to them, find the management-plane systems that give an attacker the most leverage, rank boundaries to harden, design a segmentation test matrix and choose detections for boundary crossings. Everything is invented and no exploit steps appear.
This is the guided version: a yellow flash shows where to click and a bar says what to do. Switch to Free play any time.
GuidedPress the highlighted Start button. You can edit the names above first, or keep the samples.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
Loading…
Sample report · illustrative data
Sample result: attack path map
Example run on an invented freight company network: crown jewels chosen, paths ranked, boundaries tested.
Paths from one user laptop
| Path | Boundaries crossed | Leverage | Priority |
|---|---|---|---|
| Laptop > admin port > hypervisor manager > any server | 1 | Every virtual server | First |
| Laptop > app port > ERP app server > database zone | 2 | ERP database | Second |
| DMZ > server zone > backup network | 2 | Backups | Third |
Segmentation test matrix (excerpt)
| From | To | Expected | Observed |
|---|---|---|---|
| User zone laptop | Firewall console | Denied | Allowed (finding) |
| User zone laptop | Backup console | Denied | Denied |
| Jump host | Hypervisor manager | Allowed | Allowed |
Score
- Example score
- 82% (an example, not a benchmark)
- Band
- Good map, some blind spots
Debrief note
Two unexpected allowed flows into management consoles shorten every path. Fix them, then retest the same matrix rows. This is PlayCISO practice.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
TL;DRWhat this is
5 points
- A scenario lab where you are the security architect for a fictional freight company with a small, text-described network: user, DMZ, server and database zones plus a management zone holding firewall, switch, hypervisor, backup and identity consoles.
- You make 11 scored decisions: choosing crown jewels, mapping the shortest realistic attack path, ranking management-plane leverage, picking which boundaries to harden and test first, building a segmentation test matrix, reading its results, securing the admin path, backups and security tooling, choosing detections for boundary crossings and reporting to the board.
- It draws on pages we read: NIST SP 800-207 (Zero Trust Architecture), the CISA Zero Trust Maturity Model, the MITRE ATT&CK Lateral Movement tactic and the Malbear Labs report on a recovered rubric that valued boundary breaches and management or security device access.
- No exploit steps appear. The company, hosts and test results are invented.
- Defensive and educational only.
Frequently asked questions
What is attack path analysis?
It is the practice of tracing the routes an intruder could take from a likely foothold, such as a user laptop, to the assets that matter most, and counting the boundaries, accounts and permitted flows on each route. The shortest realistic path is the one to fix first. This definition is PlayCISO practice.
What is crown jewel analysis?
It is choosing the small set of assets whose loss would hurt the business most, then working out what can reach, control or reset them. In this lab that includes administrative systems, not only the data stores. NIST SP 800-207 similarly centres protection on resources (assets, services, workflows, accounts) rather than on network segments.
Why does the management plane matter so much?
Consoles for firewalls, switches, hypervisors, backups and identity can each control many other systems, so one foothold there reaches further than one server. Malbear Labs reports that a rubric it recovered weighted boundary breaches and management or security infrastructure far above individual host access, and presents that as its own reading of the operator's priorities. Read it as one report, not a general rule.
How do I test network segmentation?
Write a matrix of source zone, destination system, port and expected result, then test from real hosts in each source zone and record what is actually allowed. Pay most attention to flows that should be denied: an unexpected allow is the finding. Matrix format is PlayCISO practice.
How does this relate to zero trust?
Zero trust moves the focus from static network perimeters to users, assets and resources, and NIST SP 800-207 says location and asset ownership do not imply trust. CISA's Zero Trust Maturity Model is meant to help agencies plan zero trust implementation. Segmentation testing is one way to check that a design matches what is permitted.
What does MITRE say about lateral movement?
MITRE ATT&CK describes the Lateral Movement tactic (TA0008) as techniques adversaries use to enter and control remote systems on a network, which often means exploring the network and pivoting through multiple systems and accounts. Adversaries may use legitimate credentials with native tools, which can be stealthier.
Sources
Read on 2026-11-08. Lines in the feedback marked “PlayCISO practice” are our own reasoning, not a statement by any source. The scenarios are fictional and use made-up data.
- NIST SP 800-207: Zero Trust Architecture (August 2020; no implicit trust, protect resources not segments)
- CISA Zero Trust Maturity Model (Version 2.0; archived page)
- MITRE ATT&CK: Lateral Movement (TA0008) (tactic definition and nine techniques)
- Malbear Labs: Operation Snowball (Malbear Labs reports a recovered rubric weighting boundary breaches and management or security devices; the reading is the author's)
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.