A sequence of weaknesses that, taken together, lead from an entry point to a valuable asset. Each weakness is tolerable alone; it is the chain that counts.
An instance reachable from the internet carries an exploited CVE. It assumes a role that can read a database. That database holds personal data, and its snapshot is shared with another account. Four findings, none critical alone; together, a path from the internet to your customers.
Toxic combinations are chains written in the catalogue and paths computed on the graph. Each receives a score out of 100 from its severity, its length and the resources involved, then adjusted by what the graph knows: reachable from the internet, known exploited CVE, sensitive data reached. The Remediation tab says which link to break. The Sapper, an assistant, searches for paths no rule describes yet.
The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.