A critical path is the set of systems, services, and dependencies that must function for a service to operate normally. It can include internal infrastructure as well as external providers, such as identity, hosting, payment, or data services.
Security teams map critical-path dependencies to understand how a failure or compromise could disrupt operations. For example, if a platform depends on a supplier for authentication, an outage or security incident at that supplier may prevent users from accessing the platform even when its own systems are working. Inventorying these dependencies, identifying alternatives, and planning recovery helps limit outages and contain risks that can cascade through connected services.