Attackers who compromise an identity inherit its group memberships, and everything those memberships transitively reach. That makes group structure attack surface: every path into a privileged group is a lateral movement route, and defenders who cannot see the paths are defending a map they do not have.
The structural security questions#
The questions that matter in both prevention and response:
- Reach: from any given identity, what is transitively reachable, and which paths lead toward privileged groups?
- Change: did the structure move, a new membership, a new nesting edge, in a way that widened someone's reach?
- History: during the incident window, what exactly changed, as a complete diff rather than sampled events?
Lists defend poorly against graphs#
Adversary tooling has treated directories as graphs for years, computing the shortest path from any foothold to the crown jewels. Defenders working from flat membership lists are analyzing the same terrain with strictly worse instruments, and the asymmetry is the attacker's head start.
VisualizerEngine
How VisualizerEngine serves security work
The force-directed graph shows reach and paths natively, alerts flag structural changes as they happen, and snapshot diffs give incident response the before-during-after states without event archaeology. The platform itself is read-only with three Graph scopes, so deploying it adds sight without adding write-path attack surface, and its own audit trail is HMAC-chained and tamper-evident.