Concept
Exposure and Tier Zero protected
The numbers that tell you how exposed your domain is, how severe each finding is, and how much of Tier Zero no open attack path reaches.
On this page
In one sentence: the headline is how many accounts have an attack path to Tier Zero (lower is better), the status says how bad that is, and Tier Zero protected counts the Tier Zero objects that no open attack path leads to (higher is better).
Why count accounts?
Every user and computer is a possible starting point. Attackers rarely choose where they land: they get whoever clicks the phishing link, whichever laptop runs the malicious installer. So the question that matters is not "is there a path?" but "how many starting points have one?"
If 3 accounts out of 20,000 can reach Tier Zero, an attacker needs to be lucky. If 7,000 can, they almost can't miss.
Accounts with an attack path to Tier Zero
The population is every enabled user and computer outside Tier Zero. The headline is how many of them have any attack path to Tier Zero. Each one is a way to take over the domain, so it is the number to drive to 0.
Tier Zero exposure is the same count as a share of the active accounts: those that signed in within the stale-account window (90 days by default) before the collection. It shows how widely the paths are spread and how that moves between runs.
Illustrative numbers. 0% means no ordinary account has any path to Tier Zero.
The count leads pathwarden posture, the report's overview and the app's home page. pathwarden exposure shows it per domain, with example paths.
The Tier Zero status
The status next to the headline comes from the paths and the open findings, never from a share.
| Status | When |
|---|---|
| Critical | A group that holds nearly every account (Domain Users, Authenticated Users, Everyone) can reach Tier Zero, or a critical finding is open. |
| High | At least one account outside Tier Zero can reach it. |
| Moderate | No account can reach it, but findings at Medium or above are open. |
| Low | No account can reach it, and nothing at Medium or above is open. |
A small share can't make it Low: 509 accounts are 0.13% of a 400,000-account domain and still 509 ways in.
Finding exposure and severity
Each attack path finding has its own exposure: the share of its domain's users and computers that can reach the finding's starting point. A route that already passes through Tier Zero doesn't count, since whoever gets there has already won. Kerberoasting, AS-REP roasting and NTLM relay to AD CS can be done by anyone on the network, so their exposure is everyone.
Severity follows exposure, using the same bands as BloodHound Enterprise:
| Share of the domain that can use it | Severity |
|---|---|
| 95% or more | Critical |
| 80% or more | High |
| 40% or more | Medium |
| Less than 40% | Low |
With one exception: direct control of the domain is never below High, however few accounts can start it. DCSync, control of a Tier Zero object, a Tier Zero account signed in elsewhere, unconstrained delegation and AD CS abuse that ends in the domain all have a floor of High, because one account that can DCSync is a domain compromise whatever the percentage.
Hygiene findings keep their rule's own severity. To use every rule's own severity instead, set severity = "static" under [rules] in pathwarden.toml.
Tier Zero protected
Tier Zero protected looks at the problem from the other side: how many Tier Zero objects no open attack path finding leads to, out of all of them.
Illustrative numbers. Higher is better.
- 59 of 59 means no open attack path finding reaches Tier Zero.
- Accepted risks don't count against it.
- Each Privilege Zone gets its own count of protected objects.
The two numbers can move apart. An attack path that anyone on the network can start, such as an NTLM relay to a certificate authority, adds no accounts to the count. Once every other path is closed, the count is 0 while that finding still reaches one Tier Zero object: 58 of 59, and the status is Moderate, not Low.
The count tells you how many ways in there are. Tier Zero protected tells you how much of what you're protecting is still reachable. Watch both over time: pathwarden history and the app's Progress page chart them run by run.
Collection completeness: how much you can trust the numbers
Paths through logons and local administrator rights can only be seen if sessions and local groups were collected for those computers. Collection completeness is the share of recently active computers whose sessions and local groups were collected.
If it's low, treat the count as a lower bound: the real number can only be higher. A Quick collection doesn't read sessions or local groups at all, and says "Not targeted" instead of a percentage. See collecting data for how to get full coverage.
Where to see them
pathwarden posture -i <collection> -c pathwarden.toml: the count, the status, exposure, Tier Zero protected, findings by category and collection completeness.- The report's Overview tab, and the Collection tab for completeness.
- The app's home page and Progress page.
pathwarden history: the trend across scheduled runs.
References
- SpecterOps BloodHound docs: Privilege Zones
- Pathwarden: How it works