Think like a hacker: How to disrupt attack paths before they form

Fujitsu / April 30, 2025

Uvance Hybrid IT Data and Security Security

Enterprise security teams often face a tidal wave of vulnerabilities, yet patching is typically owned by IT, not security. Even so, adversaries continue to find ways into business-critical systems. While some exposures are clearly severe, others may appear minor – such as overlooked cloud misconfigurations or stale credentials – but can still be chained together to devastating effect. Simply trying to “patch everything” is unsustainable and risks diverting attention away from issues that truly matter.

A more effective approach is to view your environment from an attacker’s perspective. Instead of focusing only on known Common Vulnerabilities and Exposures (CVEs), consider how adversaries exploit identity weaknesses, unchecked permissions, and forgotten credentials to move laterally and reach high-value assets. This shift aligns with Continuous Threat Exposure Management (CTEM) – a five-step framework defined by Gartner to continuously identify, prioritize, and remediate security gaps. CTEM can be applied to any environment, helping teams mobilize remediation efforts efficiently rather than drowning in endless vulnerability lists.

Understanding how adversaries really operate
Choke points vs. dead ends: focus on what matters
Uncovering overlooked exposures and the power of the Fujitsu CTEM Managed Service
Why Fujitsu is working with XM Cyber to deliver the CTEM Managed Service
Adopting a different perspective

Understanding how adversaries really operate

Many adversaries are opportunistic and will use anything available to them – ranging from known CVEs to overlooked credentials and stealthy “living off the land” binaries or scripts (often referred to as LOLBAS). This approach allows them to blend into legitimate network processes, avoid detection, and escalate privileges when needed.

Attackers typically chain smaller weaknesses – such as misconfigurations, unmonitored or leftover credentials, and security controls that remain disabled or were never enabled – to move toward their targets. Privilege escalation may be vertical, in which attackers gain higher-level access on the same system, or horizontal, where they move to a different system with similar privileges, depending on which path offers the best foothold. Because organizations often lack full visibility into these hidden gaps, adversaries can exploit them well before they show up in any CVE list.

By viewing your environment as adversaries do – looking for unprotected identity paths, weak internal configurations, and opportunities for stealth movement – you can better identify exposures that truly matter. This shift in perspective is essential to CTEM, where each gap is assessed in context. Instead of attempting to patch every single issue, CTEM directs you to the exposures that pose the highest risk first, maximizing the impact of your limited security resources.

Choke points vs. dead ends: focus on what matters

Many organizations discover tens of thousands of exposures across on-premises, cloud, and identity infrastructures. However, not all of these exposures enable adversaries to access critical systems. Some are effectively “dead ends,” providing no viable route to sensitive assets or data. Others converge on a single entity – referred to as a choke point – where remediating one endpoint can disrupt multiple potential attack paths at once.

Although only about 2% of exposures in a typical environment serve as choke points, remediating them can significantly reduce risk. For example, a single host might harbor multiple vulnerabilities that collectively allow lateral movement toward business-critical systems. Addressing these issues together on that one host is far more efficient than randomly patching unconnected exposures.

By identifying choke points, organizations can make the most of limited resources and avoid “patch everything” fatigue. Using the CTEM framework, defenders can assess the real impact of each discovered gap, ensuring that remediation focuses on the issues most likely to affect critical systems, rather than those that present little or no actual threat.

Uncovering overlooked exposures and the power of the Fujitsu CTEM Managed Service

Modern IT environments evolve quickly: cloud components spin up or get redeployed, new configurations appear without notice, and existing services often change faster than security teams can track. Conventional point-in-time approaches – such as quarterly penetration tests – are valuable for assessing controls and processes but do not provide continuous visibility. New exposures can arise daily, giving adversaries a fresh opportunity to slip into critical systems before security teams even realize a gap exists.

The Fujitsu CTEM Managed Service, powered by XM Cyber, addresses this challenge by identifying exposures in near-real time and assessing how they might be chained together in genuine attack paths. The XM Cyber platform dynamically creates digital twins of relevant systems – only for the duration of each attack scenario – so it can safely simulate adversary tactics without impacting production. This allows the Fujitsu CTEM Managed Service to reveal how a single misconfiguration or overlooked credential might escalate into broader compromise across on-premises or multi-cloud environments.

By continuously pinpointing newly introduced exposures and validating their potential impact, the Fujitsu CTEM Managed Service helps organizations reduce the window of opportunity for adversaries. Rather than relying solely on periodic security exercises, teams have a proactive method to detect, prioritize, and remediate issues that arise on a day-to-day basis – sustaining a far more resilient security posture over time.

Why Fujitsu is working with XM Cyber to deliver the CTEM Managed Service

The Fujitsu CTEM Managed Service combines mature technology with comprehensive security expertise. XM Cyber’s Attack Graph Analysis forms the technical foundation, continuously mapping every exploitable path across on-premises, multi-cloud, and identity layers. Fujitsu wraps this technology in a fully managed model, offering consultative guidance and ensuring alignment with your unique business objectives.

1. Scoping: Fujitsu consultants work with you to identify your most critical assets.
2. Discovery: Using the XM Cyber platform, Fujitsu uncovers misconfigurations, identity risks, and vulnerabilities across your estate.
3. Prioritization: Fujitsu CTEM engineers use insights from attack graphs to highlight choke points, focusing your attention on the few exposures that truly matter.
4. Validation: The Fujitsu CTEM Managed Service doesn’t just verify successful remediation: it also confirms the true severity of exposures to dramatically reduce false positives and negatives. By establishing how each exposure can be exploited in practice, the service accurately models your organization’s risk and focuses resources on real threats.
5. Mobilization: Fujitsu CTEM engineers work with your IT department to implement fixes and track the measurable reduction in risk.

This managed service shifts operational workloads away from low-impact tasks – like mass patching of minor exposures – and focuses on targeted fixes that reduce real risk. By continuously analyzing attack paths, organizations can reclaim substantial time and resources for more strategic efforts, such as architecture upgrades and incident readiness, ultimately boosting both security outcomes and efficiency.

Adopting a different perspective

Adopting an attacker’s perspective isn’t just a slogan. It’s the most effective way to spot hidden attack paths and shut them down early. By focusing on choke points, uniting security stakeholders, and switching from intermittent tests to continuous threat discovery, you can filter out the noise and target the critical exposures that truly matter. Combining XM Cyber’s advanced attack path analytics with a fully managed service ensures you fix your most pressing issues – and stay one step ahead of determined adversaries.

If you want to uncover hidden choke points and remediate exposures before attackers find them, download our CTEM Managed Service solution guide. Or visit our webpage to see how you can “Stay ahead of threats, fix what matters and protect your organization”.

James Frith

Global CTEM Service Owner, Fujitsu

James is an Enterprise Architect and has been in the IT industry for 36 years, the last 25 with Fujitsu. He has extensive experience in both Public and Private sectors, working with strategic partners to bridge the gap between business strategy and technology execution. He is passionate about leveraging cybersecurity best practices to protect critical assets, minimise risk exposure, and enable business innovation.