Why Raw Alert Counts Are Useless
A traditional vulnerability scanner might report 10,000 "Critical" findings across your cloud environment. A security team of five people cannot triage 10,000 alerts. They will either burn out, ignore the alerts, or fix the wrong things first.
CSPM tools solve this with security graphs — a database that models your entire cloud environment as interconnected nodes and edges, then uses that topology to calculate actual exploitability.
The Toxic Combination
Consider two VMs, both running Log4Shell (CVE-2021-44228), one of the most severe vulnerabilities ever discovered:
- VM-A: Sits in a private subnet. Has no public IP address. Its IAM role has no permissions to any sensitive data.
- VM-B: Has a public IP address. Port 443 is open to
0.0.0.0/0. Its IAM role grantss3:GetObjecton a bucket namedcustomer-credit-cards.
A traditional scanner marks both as "Critical — fix immediately." A CSPM graph engine reasons differently:
VM-A's attack path: Internet → (blocked, no route) → VM-A → (no permissions) → nothing sensitive. Risk: Low.
VM-B's attack path: Internet → VM-B (exploitable via Log4Shell) → IAM Role → customer-credit-cards S3 bucket. Risk: Critical. This is a complete breach scenario.
The CSPM surfaces VM-B as an Attack Path — a chain of conditions that, taken together, represent a realistic end-to-end exploit. The "toxic combination" is the intersection of three factors:
- Reachability (exposed to the internet)
- Exploitability (known vulnerability or misconfiguration)
- Impact (access to sensitive data or high-privilege credentials)
Any one factor alone is manageable. All three together is a fire drill.
A common senior interview question: "How do you prioritize which vulnerabilities to fix first when you have thousands of findings?" The CSPM graph answer is the gold standard response: prioritize by exploitability in context, not by CVSS score alone. A CVSS 10.0 vulnerability on an air-gapped internal server is less urgent than a CVSS 7.5 vulnerability on an internet-facing server with access to your most sensitive data. Mention the "toxic combination" framework: reachability + exploitability + impact.