Choke Points
A choke point is a real entry node that serves as a gateway to a large part of your attack surface. Each one is scored by everything reachable from it.
Why choke points rather than paths
Attack path analysis produces a lot of paths, and paths overlap heavily — the same internet-facing node is usually the first hop in hundreds of them. A queue of individual paths asks you to fix the same node hundreds of times.
Choke points invert the view. Instead of ranking paths, they rank the nodes that paths run through, so the work is ordered by how much of the surface each fix removes.
What each row carries
| Column | Meaning |
|---|---|
| Entry node | The real resource that serves as the gateway |
| Severity | Critical or high, by what is reachable |
| Paths | Every attack path that runs through this node |
| Crown jewels | Every crown-jewel asset reachable from it |
Reading the view
The strip above the table gives entry-node count, the critical and high splits, total paths and total crown jewels reachable. A small number of entry nodes carrying a large share of total paths is the normal and useful shape — it means a handful of fixes collapse most of the graph.
Deduplication
Choke points are deduplicated by real entry node. Without that, the same gateway appears once per path it participates in, and the ranking becomes a popularity contest between duplicates of one resource.
Related: Attack Path for the full paths behind each choke point.