Over the past months, Defender CSPM attack path analysis has come up in almost every Azure security project I've worked on. One pattern keeps repeating: recommendations and alerts stack up so fast that nobody sees the big picture anymore. The attack path view in Microsoft Defender for Cloud helps here. I no longer scroll through endless lists. Instead I get a visual map of how a real attacker could get from an exposed VM to stealing data. That puts risk at the center of cloud security, not just hygiene.
Attack path analysis is available in two Microsoft portals
In the Azure Portal, the feature lives under Microsoft Defender for Cloud → Attack paths. It also shows up in the Exposure Management section of the Defender portal, which is useful if you manage security across several Microsoft products. There is one condition, though. You need the paid Defender CSPM plan, because the free Foundational CSPM tier doesn't include it (more on that below). What I like is that attack paths are more than a nice graphic. They're built into everyday security workflows. You can filter them, rank them by risk and get down to the vulnerable resource or the overprivileged identity in a couple of clicks.
Defender CSPM builds attack paths by linking exposures together
Defender CSPM's exposure management pulls together real-time data on internet exposure, known vulnerabilities and identity privileges. Since last year it also includes sensitive data sources such as Key Vaults and Storage Accounts. From that data it constructs possible attacker journeys by connecting the individual elements. You don't just see isolated weaknesses, you see plausible chains an attacker could actually use. Prioritization is by risk, not by how many recommendations pile up. Rare but dangerous combinations therefore get noticed, for example a sensitive Storage Account that's reachable from the internet through a misconfigured subnet, combined with a Service Principal that has far too many permissions.
Here's a simple flowchart of such an attack path:
flowchart TD
Internet["Internet"] --> VM["VM with vulnerability"]
VM --> Identity["High-privilege identity"]
Identity --> KeyVault["Key Vault with sensitive keys"]
KeyVault --> Exfiltration["Data exfiltration"]
Figure: Example of an attack path mapped by Defender CSPM
Defender CSPM maps these attack vectors across different resource types and identities. Every step is based on connections and exposures it has actually discovered in your environment.
Cloud Security Explorer lets you write queries for your own risks
Apart from the automatically generated attack paths, the Cloud Security Explorer in the Defender for Cloud portal lets you run your own "what-if" queries. You could, for instance, look for every internet-exposed resource with exploitable vulnerabilities and filter by subscription, resource type, sensitivity or identity. I find this view most helpful in complex environments and during audit preparation. It shows how infrastructure, identities and data relate to each other, and it does so in a form you can act on.
Practical tip: Save your most important scenarios as queries in Cloud Security Explorer, such as high-risk environments or new attack surface after a major change. That saves time, and you can follow your risk trends over time.
Microsoft's concept guide on attack paths and the how-to on managing attack paths go into more detail.
Useful results depend on agentless scanning and the paid plan
If you want attack path results that mean something, agentless scanning has to be enabled on all relevant subscriptions and resource groups. The Defender CSPM plan is billed per resource (VM, Storage Account, etc.), and teams often underestimate that cost in practice. The free Foundational CSPM plan gives you basic posture recommendations. Attack path analysis and Cloud Security Explorer are only in the paid CSPM plan, though.
Agentless scanning works without Azure VM extensions. The resources do have to be hosted in Azure and fall under Defender's policy coverage. For hybrid scenarios I always recommend adding Defender for Servers, which I covered in my practical guide to choosing Defender for Servers Plan 1 or 2.
Agentless scanning is switched on in three portal steps
- Azure Portal → Microsoft Defender for Cloud → select environment
- Go to "Coverage" → Agentless scanning → Enable
- Check that all required resource types (VMs, Storage, etc.) are covered
Prioritizing by risk changes how teams work together
Classic recommendation lists rarely tell you which risks actually matter for the business. Defender CSPM attack paths move the focus to the most likely and most damaging attack chains instead of hygiene checks. In my experience this makes conversations with operations and business teams a lot easier, because I can show them concrete attacker journeys rather than abstract technical findings. The results also fit well into change management, and they help when you need to justify an investment or a policy change.
If you want more background, Microsoft's overview of cloud security posture management is a good starting point with further links.
I now consider attack paths essential
The real value of Defender CSPM attack paths shows once you use them in daily security work. The visual map helps me find weaknesses, and it also shows me which mitigations really lower the overall risk. Combined with Exposure Management and the vulnerability reports from Defender for Servers (see my first steps with Security Exposure Management and its real-world impact), you get a fuller picture of your risk than recommendations alone can give you.
So I don't see attack path analysis as an optional extra anymore. In any larger or older Azure environment it has become a must-have if you want real transparency, sensible prioritization and visible progress on closing serious security gaps.
