Reading a simulation result: kill-chain, viable path, exposure score
A simulation result is not a pass/fail. It is a set of kill-chains, each with a verdict, a break point and an exposure sub-score, that roll up into one global figure. Read in the right order, it tells you not just what is exposed but which of your controls is already holding the line.
The unit is the scenario, and the scenario is a kill-chain
Each scenario is a short sequence of steps — the way a real attack progresses. A step is marked passed when the attacker's move succeeds against the tenant's configuration, blocked when a control stops it, and inconclusive when the signal cannot be observed read-only. « Passed » here is bad news: it means the step worked for the attacker.
Reading a scenario top to bottom shows exactly where the chain either completes or breaks. That is more useful than a verdict on its own, because it tells you which link matters.
Viable, interrupted, inconclusive
| Verdict | Meaning | What to do |
|---|---|---|
| Attack path viable | The chain completes end to end: every decisive step passed. | Treat as a real finding. Fix the earliest step you can — closing one link breaks the whole chain. |
| Attack interrupted | A control blocked the chain before it completed. | Note the break point. This is a control that works — name it, and don't weaken it. |
| Inconclusive | A decisive signal isn't observable read-only. | Verify in the portal. The simulator says « I can't see », not « you're fine ». |
The break point is the useful part
When a chain is interrupted, the result names the exact control that stopped it — the break point. This inverts the usual audit narrative. Instead of only listing what is wrong, the simulator tells you what is right: « this password-spray path was interrupted by Security Defaults », « this consent path was interrupted because user consent is restricted ». In a debrief, break points are how you show that existing investments are earning their keep.
How the exposure score is built
Every scenario produces an exposure sub-score out of 100, driven by how far the chain got and how decisive the passed steps were. The global exposure score is the aggregate across the scenarios you ran, and the viable-path count is the number of chains that completed end to end. Two figures, two jobs: the score is the trend line you watch over time; the viable-path count is the headline you act on now.
Watch the score, act on the paths. A score that drops from 62 to 40 across two runs is good news; but the number that changes a decision is « viable paths: 18 → 6 ». Report both, lead with the paths.
Reading order that works
- Start with the viable-path count, not the score. It is the count of chains that actually complete.
- Open the viable scenarios first. Read each kill-chain to the step that made it viable — that step is your cheapest fix.
- Fix the earliest decisive step. Breaking one link interrupts the whole chain; you rarely need to fix every step.
- Read the interrupted scenarios for the break points. These are the controls to protect, not the ones to ignore.
- Verify the inconclusive ones in the portal before you claim or dismiss them.
- Re-run after remediation and compare the viable-path count. That delta is the proof of work.
Why the same score can hide movement
Like the audit, a stable global score can mask change underneath: two scenarios fixed, two others newly viable because a Conditional Access exclusion was added last week. This is why the viable-path list — not just the number — matters, and why keeping every run in history lets you compare like for like. Read the paths that are new since last time first; they usually point to a recent change rather than an old gap.