A reachability graph is a map of the systems, services, data, and actions that become available when permissions and dependencies are combined. Instead of asking only what an identity is allowed to do on paper, it shows what it can actually get to by following valid paths through tools, APIs, workflows, and trust relationships.
In cyber security, this matters because attackers and autonomous agents often exploit paths, not single permissions. A modest account may still reach sensitive resources if it can chain actions across internal services or reused credentials. Defenders use reachability analysis to find unintended routes, reduce over-connected trust, and spot where a low-risk permission becomes dangerous when combined with another. It is a practical way to identify attack paths, limit lateral movement, and tighten access reviews around real system behavior.