Attack Flow: From Data Points to Data Paths

Gabriel Bassett traces the idea back to a government risk assessment where spreadsheet scoring and five-by-five matrices failed to explain why analysts disagreed. Writing out the reasoning revealed that the real content was attack paths: sequences of attacker actions against assets, each with an effect. He presents Attack Flow, a schema built around actions, assets, properties, relationships and flows, which lets those paths be stored as graph data.

The middle of the talk surveys common security data, including red team reports, attack simulation code, signatures, threat intelligence feeds, incident response notes and budget lists. Most of it is flat text, weakly linked, or aggregated in ways that hide context. Bassett converts sample red team and incident data into Attack Flow, loads it into a graph database, and queries it for compromised assets and frequent actions. He also explains how the same path can be read from red or blue team perspectives, and how mitigations can be assessed as a group against a path rather than one vulnerability at a time.

He closes with possible extensions: modeling normal behavior, mapping blast radius between systems, linking external threat actor data, and using link prediction to suggest steps an investigation may have missed. He points attendees to the public schema and converter repositories, noting that the project is new and still needs tooling and training.