Many security guides treat cyber attacks like single, isolated alerts, like a virus alarm going off or a firewall blocking a packet. In reality, hackers follow a connected chain of steps. By mapping out exactly how an attacker moves from step to step, defenders can easily find where to break the chain and stop the attack completely.
How Attacker Steps Depend on Each Other
Standard security checklists list hundreds of hacker techniques, but they treat them like a flat list of items. In the real world, a hacker must complete each step in order. If they can't get into your network, they can't run their tools. If they can't run their tools, they can't steal your data. Breaking just one link in this chain makes the entire attack fail.
The 4-Phase Adversary Loop
Intrusions consistently follow the RINSE & Repeat loop:
Breaking the Three Keys to a Successful Attack
To succeed at any phase, a hacker needs three things to line up: they must be able to reach the target (Reachability), have the right tools (Capability), and exploit a weakness (Exploitability). If a defender blocks even one of these, the attack fails.
This is where attack graph analysis becomes essential. Rather than viewing vulnerabilities in isolation, attack graph modeling visualizes every potential path an adversary can traverse across these three variables. By mapping identity relationships, network reachability, and capability boundaries into a unified graph, defenders can identify non-obvious chokepoints and eliminate entire attack paths before an adversary ever reaches their objective.
The Threat Modeling Matrix
To build a unified defense model, we map these variables across the three primary layers of structural system architecture:
| Dimension | Reachability (Oxygen) | Capability (Fuel) | Exploitability (Heat) |
|---|---|---|---|
| Endpoint | Exposed administrative host ports (SSH, RDP) or active physical consoles. | Malware binaries, post-exploitation toolkits, rootkits, or hijacked credentials. | Local kernel privilege escalation bugs, weak folder ACLs, or unpatched clients. |
| Network | Publicly routable IP routing paths, unsegmented VLAN subnets. | Custom C2 protocol listeners, packet sniffing payloads, DNS tunnel clients. | Missing egress firewall rules, unencrypted protocols, open WAN overlays. |
| Services | Reachable public socket bindings, exposed API endpoints, web forms, and conversational chatbots. | Exploit payloads targeting web engines, parameter manipulation scripts. | SQL injection vulnerabilities, unauthenticated API paths, default credentials. |
| AI Agent Autonomous insider | Tool-granted reach into filesystem, network, and secrets, active at runtime, not waiting to be called. Untrusted external content (web pages, emails, documents) becomes the delivery channel, bypassing all network perimeters. | The agent's own authorized toolset: shell execution, database queries, API calls, secret access. No malware needed: injected instructions weaponize legitimate capabilities the agent already holds. | Missing trust boundary between system instructions and ingested data; over-permissioned tool grants; absent human confirmation gates for sensitive operations. Unlike other dimensions, the attacker exploits trust, not a bug. |
Applying First-Principles Countermeasures
Understanding these variables changes how security architectures are engineered:
- Locking the Door (Eliminating Reachability): Chasing and patching every single software bug (Exploitability) is exhausting and impossible. Instead, we can hide administrative ports inside private, encrypted software-defined overlays. To the public internet, these entry points simply do not exist. This increases the cost of infiltration exponentially for attackers, forcing them to somehow hijack an authorized device, while remaining completely free and simple for defenders.
- Disarming the Attacker (Gating Capability): Even if an attacker finds a way in, they need custom tools and malware (Capability) to do damage. By configuring systems to only run pre-approved, trusted software, we render any attacker's custom scripts and tools inert. Wherever possible, execution environments should leverage ephemeral touchpoints: running workloads in isolated, short-lived containers or microVMs that automatically roll back to a known clean state after every task. They may be inside, but they are effectively disarmed and incapable of persisting.
- Building Safe Foundations (Reducing Exploitability): Developers can choose to build systems using modern, memory-safe programming languages (like Rust). This structurally prevents common software bugs from being created in the first place, stopping vulnerabilities before the code is ever deployed.
The AI Agentic Age: Turning Defense Inside Out
As organizations integrate autonomous AI agents to parse files, read emails, and search the web, the traditional boundary rules change. While a private network overlay successfully eliminates the attack surface for direct network attacks, it cannot stop a new breed of threat: Indirect Attacks.
If an internal AI agent is equipped with tools to search the internet or read user-uploaded documents, an attacker does not need to compromise the network perimeter. Instead, they place a malicious instruction (an indirect prompt injection) on a public website, in a PDF document, or inside an email.
When the AI agent reads this untrusted content, the hidden prompt instructs the agent to execute unauthorized actions:
- Running administrative commands or scripts in the local environment.
- Downloading secondary malware payloads from external servers.
- Exfiltrating sensitive data retrieved from internal databases.
By exploiting the agent's trust, the attacker turns system defense inside out. The threat is not forced in from the outside; it is invited inside by the autonomous agent, completely bypassing firewall layers and private WAN overlays. Modern threat models must treat AI tool boundaries and untrusted ingestion channels as critical Reachability vectors.
Technique-Level Defense Doesn't Scale
Every era produces a new defense instinct aimed at the technique layer: malware signatures, reactive vulnerability patching, now prompt injection classifiers. The instinct is always the same: build a filter, a block list, a classifier for that technique. But the attack surface at the technique level is always infinite. Adversaries adapt, mutate, and obfuscate faster than any block list can keep up.
Agentic Countermeasures: Designing Trust Boundaries
To defend autonomous agents against indirect exploitation, we apply first-principles containment strategies across Reachability, Capability, and Exploitability variables:
| Principle | Maps to | What it does | Concrete example |
|---|---|---|---|
| Contain | Reachability (Oxygen) |
Locks the agent runtime inside an explicit boundary: network, filesystem, and service reach are all scoped to the task. The attacker's delivery channel hits a wall before it can touch infrastructure. | Ephemeral microVM (Firecracker) with no host filesystem mount; egress firewall permitting only pre-approved domains; private overlay network blocking all unregistered peers. |
| Curtail | Capability (Fuel) |
Static reduction: the agent's permission inventory is stripped to the minimum the current task requires, before it runs. Injected instructions cannot weaponize tools the agent was never granted. | Read-only file access where write is not needed; no ambient credentials in environment (secrets proxy daemon, not env vars); tool allowlist enforced at the harness level, not the model level. |
| Control | Exploitability (Heat) |
Dynamic governance: closes the gap between receiving an instruction and executing it. Untrusted content is structurally separated from system directives; sensitive actions require an explicit human gate before they fire. | XML delimiter isolation (<external_untrusted>…</external_untrusted>); typed JSON schema for all tool arguments; human-in-the-loop confirmation for destructive or outbound actions; immutable audit log per agent turn. |
Next Step: How AI Capabilities Redefined the Modern Attack Surface
Now that you've mapped multi-stage adversary chains and agentic containment principles, trace the historical progression of how AI capability milestones systematically created new classes of attack that legacy security models were never designed to handle.
Read "From Conversation to Action: How AI Redefined the Attack Surface" →