Security teams have become skilled at validating individual defenses: whether an EDR agent catches a payload, whether a phishing simulation fails, whether a SIEM rule fires on a specific technique. Mature organizations run these checks continuously.

But isolated testing does not address the core problem. Attackers, increasingly AI-powered, do not test techniques one at a time. They chain them: a phishing email leads to credential harvesting, which yields a foothold, then privilege escalation, lateral movement, data staging, and exfiltration. Any single step might be caught, but with so many potential exposures, fixing 90% still leaves a broken link that makes an attack path exploitable. What matters is whether the full sequence is caught, or whether it slips through gaps between tools, teams, and alerts.

According to Filigran's State of Threat Management report, 93% of security leaders say their organization suffered a business-impacting cyberattack in the past 12 months, despite most having validated defenses. 88% say AI is accelerating attacker movement once inside, and 84% point to siloed tools and disconnected testing as a main reason exposures go unnoticed. The 2025 breach of France's tax authority, the DGFiP, followed a coordinated chain of initial access, credential abuse, lateral movement, and exfiltration, turning individually survivable weaknesses into a major breach.

Attack Chaining in OpenAEV automates multi-stage attack paths end to end, continuously and at lower cost than manual red teams. Instead of isolated events, actions are linked into a live sequence: a harvested credential, open port, token, or misconfigured permission is captured and used to decide the next step, branching in real time on an interactive graph. A red team is thorough but expensive and periodic, while Attack Chaining runs in minutes, as often as needed, providing an always-current answer to where an adversary would get through today.

Five capabilities support this: open, conditional chaining logic; live attack path mapping; transparent findings that surface chokepoints; scope and safety controls; and social engineering as a first-class stage. Chains can run in operator-led mode or fully autonomous mode via XTM One, where an AI agent plans, executes, and adapts the attack path, calling on specialist agents for payload creation, code generation, recon, and exploitation. Both modes use the same conditional engine and scope controls, delivering end-to-end simulations in minutes, repeatable as environments change, with results feeding into a unified exposure score.

Organizations breached despite passing security testing usually did not fail a control test. They failed a chain test they never ran. Attack surfaces are made of individual weaknesses; attacks are made of chains. Testing must match what it defends against.

Filigran is hosting a live technical webinar on attack chain testing. Sessions: Europe, Tuesday, September 29th at 11am CEST; Americas, Thursday, October 1st at 11am EDT.

Source: The Hackers News