Enable DevOps attack path analysis
Implementation Effort: Medium – Turning on attack path analysis depends on enabling Defender CSPM and DevOps connectors and then tuning which chained findings to prioritize, involving both security and platform teams.
User Impact: Low – Attack path graphs are generated and reviewed by the security team; end users are neither prompted nor affected.
Lifecycle Stage: Run
Overview
Enable DevOps attack path analysis in Microsoft Defender for Cloud so your organization can identify chained weaknesses across repositories, pipelines, identities, and cloud resources before they are exploited. Traditional vulnerability management treats each security finding in isolation — a single exposed secret, a single misconfigured storage account, or a single over-privileged service connection.
Threat actors do not exploit findings in isolation. They chain weaknesses together, and teams that only review findings one at a time can miss moderate findings that form a direct attack chain to high-value resources.
Microsoft Defender for Cloud attack path analysis builds a graph of the cloud and DevOps environment and identifies the sequences of weaknesses a threat actor could exploit to reach sensitive resources. With Defender CSPM and DevOps connectors enabled, the graph can include repositories, pipelines, service connections, and exposed secrets alongside cloud infrastructure such as virtual machines, databases, and identity assignments.
The analysis surfaces the paths that pose real, exploitable risk and recommends specific actions — such as rotating a secret, tightening a service connection's scope, or enabling branch protection — that break the chain at the most effective point.
This capability helps teams prioritize remediation based on exploitability instead of reviewing each alert in isolation. It is especially valuable when individually moderate issues become high risk only when they are chained together. By mapping how chained weaknesses could be exploited to reach sensitive resources, this task supports Assume breach, focusing defenders on the paths a threat actor would actually take rather than on isolated findings.
The signal feeding these graphs is improving as code-level findings gain runtime context. The integration between Microsoft Defender and GitHub Code Security (now generally available) enriches code vulnerabilities with production signals such as internet exposure and data sensitivity, and Microsoft's multi-model agentic scanning harness (codename MDASH, announced at Build 2026 and in expanded preview) adds validated, proven-exploitable code findings. As you adopt these capabilities, exploitable code-level risk becomes part of the same Defender attack-path view as infrastructure and identity weaknesses, strengthening end-to-end prioritization. This runtime-enriched code-to-vulnerability prioritization currently applies to the GitHub Code Security integration; Azure DevOps still contributes DevOps posture and connector data to Microsoft Defender for Cloud, but does not provide the identical GitHub code-to-runtime enrichment.