An attack graph is a map of the paths an attacker could follow through systems, identities, applications, and services. Each node represents a reachable asset or state, and each edge represents a step such as exploiting a flaw, reusing credentials, abusing trust, or moving through a connected API.
Attack graphs matter because the most dangerous risk is often not one severe vulnerability, but a chain of smaller issues that link together. Defenders use them to spot where a low-severity weakness becomes critical when it reaches a privileged account, sensitive data, or an automation tool. In real attacks, an attacker may combine misconfigurations, over-permissioned identities, and exposed services to move laterally. In defense, attack graphs help prioritize patching, segmentation, least privilege, and monitoring where they break the chain.