Findings and attack paths

Part ofMap and test your attack surface Research a threat or a vulnerability

This page explains how to read and act on what ATLAS finds: the vulnerabilities and misconfigurations on each host, and the attack paths that connect them to your crown jewels. It shows you how to ticket a finding, accept a risk, and find the one fix that cuts a whole path.

Who can do this

Everyone with access can read findings and attack paths. People with the admin or user role can ticket findings and accept risks.

Findings

Open Findings in the header. The summary next to the heading reads, for example, "20 open · 4 critical · 1 accepted".

How findings are grouped

Findings on an attack path come first, so you see what matters most at the top:

one section per attack path, for example "Path 1 · Internet → VPN → AD → EPD", with the host it "ends at";

then Not on an attack path, "ranked by CVSS".

Each section shows how many findings it holds.

What each finding shows

Column	What it shows
Host	The host and the port with its service, for example `443/https`, and the host's full name. Choose the host to open it.
Finding	The title and the issue number: a CVE number for a known vulnerability, or a Soveryne check number starting with `SVY-` for a configuration weakness. Choose it to open the finding.
Severity	The severity and the CVSS score, for example "Critical · CVSS 9.8". For a CVE, the EPSS score and KEV when the vulnerability is in the CISA catalogue of known exploited vulnerabilities. For a configuration weakness, "Config check".
Status	Open, Ticketed with the ticket reference, Risk accepted or Fixed.
Actions	Ticket and Accept.

ATLAS uses three severities, based on the CVSS score:

Severity	CVSS score
Critical	9.0 or higher
High	7.0 to 8.9
Low	below 7.0

ATLAS reports a known vulnerability as a finding when it is in the CISA KEV catalogue, has a CVSS score of 7.0 or higher, or has an EPSS score of 0.01 or higher. This keeps the list to what is worth your attention.

Filter findings

Use the buttons at the top right:

Open: everything still to act on.

Critical, High or Low: one severity.

Accepted / fixed: findings whose risk was accepted, and findings that are fixed.

When nothing matches, the page reads "Nothing matches this filter."

Read a finding

Choose the finding's title. The finding opens over the page.

Read the header: whether it is a "Vulnerability · CVE" or a "Misconfiguration · Soveryne check", its number, severity, CVSS score and title.

Read the tiles:

CVSS: how severe it is.

EPSS: the probability that it is exploited in the next 30 days.

CISA KEV: Listed or Not listed in the catalogue of known exploited vulnerabilities.

Public exploit: Weaponised (used in ransomware campaigns), Public (exploited in the wild, or an exploit is published), Likely (likely to be exploited soon), Not needed (exploitable with standard tools), Unclear or None known.

Published, and Affected here: how many of your hosts have it.

Read the sections:

What it is, with its source;

Remediation: what to do about it;

Observed on: the products where ATLAS saw it;

Public exploits & write-ups and Advisories & patches, with links;

Attack techniques · MITRE ATT&CK: what an attacker can do with it;

Affected hosts in your organisation, each with Open host and Ticket.

Choose Back to the host, or press Escape, to close it.

A critical finding opened, with its CVSS, EPSS, KEV and exploit tiles and its remediation

If you work for several organisations, Also seen at other organizations lists the other organisations with the same issue. Choose Switch → to open one.

Ticket a finding

A ticket records that someone is fixing the finding.

Choose Ticket on the finding's row, in the host panel, or under Affected hosts in the finding.

The status changes to Ticketed with a reference such as ATLAS-2026-A3F09C. Quote this reference in your own ticketing system.

To ticket every open occurrence of an issue at once, open the finding and choose Ticket all open.

A finding that is already ticketed or accepted cannot be ticketed again: "this finding is already ticketed".

Accept a risk

Accept a risk when the organisation has decided to live with a finding, for example because the system is being replaced.

Choose Accept on the finding's row.

The status changes to Risk accepted straight away. ATLAS records who accepted it and when. The finding no longer colours the Map.

Important

Accept takes effect at once, without asking you to confirm. Only accept a risk that the organisation has decided to accept.

What happens at the next scan

A finding you ticketed or accepted keeps that status. A later scan never reopens it, because that decision belongs to the organisation.

A finding that was open, on a host that ATLAS examined again successfully, becomes Fixed when it is no longer observed. This is what the "fixed since last scan" figures on the Reports page measure.

Look at a host's issues

Choose the host name on a finding's row, or choose a host in Inventory. The host opens over the page.

Choose Issues & techniques.

The tab sums up the host, for example "2 vulnerabilities · 3 misconfigurations · 4 ATT&CK techniques", and lists:

Vulnerabilities · CVE, each with its severity, CVSS, EPSS and KEV, the fix, its status, Ticket and Accept;

Misconfigurations, in the same way;

Attack techniques · MITRE ATT&CK, grouped by tactic: what the open issues and trust relations let an attacker do.

The Issues & techniques tab of a host, listing its vulnerabilities, misconfigurations and attack techniques

The Host information tab shows the host's identity, its services, the technologies ATLAS recognised, pages it found that are not linked from the site, and its threat model.

Attack paths

An attack path is a route from the internet to a crown jewel, hop by hop through your hosts. For each path ATLAS names the cut point: the hop where one fix removes the whole path.

Open Attack paths in the header. The page reads "Routes from the internet to a crown jewel, derived from the threat model and confirmed by reconnaissance. The cut point is the hop where one fix removes the whole path."

The Attack paths page with two routes from the internet to a crown jewel, each with its cut point

Read an attack path

Each path shows:

Its name, the number of hops and the highest CVSS score on it, for example "3 hops · max CVSS 9".

The chain of hosts, starting from INTERNET.

The Cut point: the host, the issue and its CVSS score, with what fixing it achieves, for example "Fixing this one issue removes the path — 2 downstream hosts become unreachable from the internet." If no single issue cuts the path, it reads "The path exists structurally; monitor it."

Act on an attack path

Choose Show on map to see the path on the Map, with its hops numbered.

Choose Ticket the cut point to ticket the issue that cuts the path. The button then reads Ticketed.

On the Map, the Attack paths view lists the same routes with their cut points. Choose a route to isolate it. See Change the view.

Watch: reading a finding and its attack path (about 1 min)

When no path exists, the page reads "No route from the internet reaches a crown jewel with the current findings." Check that the organisation's crown jewels are marked on the Map. See Mark crown jewels and criticality.

Troubleshooting

Message	What it means	What to do
"this finding is already ticketed" (or "already accepted")	Someone acted on the finding already.	Nothing. Reload the page to see its status.
"only an open finding's risk can be accepted"	The finding is not open.	Nothing. It is already ticketed, accepted or fixed.
"Nothing matches this filter."	No finding has this status or severity.	Choose another filter.

← PreviousThe Map Next →Inventory and reports