Attack Path Visualizer

An interactive graph that computes the predicted exploit chains through your environment, from internet-facing entry points, through lateral movement and privilege escalation, to crown-jewel assets, so a security team can see which findings actually chain into a real risk before deciding what to fix first.

This is an early-stage open-source project, not a finished commercial product. It ships with a bundled demo dataset, but it's built to import real findings from any scanner via an open JSON format. Read docs/FINDINGS_FORMAT.md before trusting its numbers on a real environment, it's explicit about what the risk score is and isn't.

Note: This project is early-stage and open to contributions from anyone — security engineers, blue teamers, and developers alike. If you'd like to help (scanner adapters are the most-needed contribution right now), read CONTRIBUTING.md and open a PR or issue. No contribution is too small.

---

What it does

Concept	How it works
Findings	Individual weaknesses —> an exposed port, a leaked key, an over-privileged role. You supply these (or use the bundled demo set).
Relationships	Directed edges saying "an attacker can get from finding A to finding B." You supply these too.
Layout	Computed automatically from relationships —> no manual coordinates. See src/lib/graph.js.
Attack paths	Found automatically by walking every route from an entry point to a crown-jewel target, then ranked by a heuristic risk score. Not a verified exploit chain — see Risk score honesty below.
Remediation	Mark a finding remediated and every path through it flips to BLOCKED live, recalculating the header's composite risk score.

Quick start

npm install
npm run dev

Open the printed local URL (defaults to http://localhost:5173). It loads with bundled demo data —>> click Import findings JSON in the toolbar to load your own (see the format doc), or Download example format to see exactly what's expected.

npm run build      # production build to dist/
npm run preview    # serve the production build locally

Bringing your own data

APV reads an open, tool-agnostic JSON format —>> full spec in docs/FINDINGS_FORMAT.md, example file at sample-data/example-findings.json. In short:

{
  "findings": [
    { "id": "e1", "label": "Exposed RDP :3389", "type": "entry", "severity": "critical", "confidence": 91 }
  ],
  "relationships": [
    { "from": "e1", "to": "a1" }
  ]
}

Write a small export script from your scanner (Nmap, Nessus, Qualys, a cloud config tool, or a manual review spreadsheet) that produces this shape, and APV handles layout and path-finding for you. See CONTRIBUTING.md if you build a reusable adapter, scanner adapters are the highest-value contribution right now.

How to read the UI

• Left —>> Discovered assets. Every imported finding, color-coded by severity (critical/high/medium/low).
• Center —>> the graph. Auto-generated left-to-right by attack depth from entry points to targets. Click any node for detail.
• Right —>> Predicted attack paths. Every entry-to-target chain APV found, ranked by risk score. Click one to highlight it in the graph.
• Mark as remediated (in the node detail panel)—> the core interaction. Simulates "what if I fixed this" and shows which paths die as a result.

A note on honesty

The risk score is average(severity weight) * average(confidence) / 100, a simple, transparent triage heuristic, not a verified exploitability score. This tool does not execute real exploits or confirm chainability the way mature tools like Pentera or Horizon3.ai's NodeZero do. If you extend this for production use, keep that distinction visible in the UI, see docs/FINDINGS_FORMAT.md for the full reasoning.

Project structure

attack-path-visualizer/
├── index.html
├── package.json
├── vite.config.js
├── docs/
│   └── FINDINGS_FORMAT.md   # the open findings JSON spec
├── sample-data/
│   └── example-findings.json
├── public/
│   └── favicon.svg
└── src/
    ├── main.jsx              # React root mount
    ├── App.jsx                # UI: graph rendering, panels, import/export
    ├── data/demoFindings.json # bundled demo dataset (in the open format)
    └── lib/
        ├── constants.js       # severity colors/weights
        └── graph.js            # layout + path-finding + validation

Stack

• React 18 + Vite
• lucide-react for icons
• No CSS framework — inline styles + a small <style> block for animations
• Pure SVG for the graph — no d3/react-flow dependency. Fine at small-to- medium node counts; for hundreds of findings, consider react-flow for virtualization and pan/zoom (see CONTRIBUTING.md)

Known limitations

• No pan/zoom on the graph yet—> large datasets will overflow the canvas.
• No persistence —> imported data and remediation state reset on reload.
• No backend, auth, or multi-user support, this is a single-session, client-only tool today.
• Path-finding assumes relationships form a DAG; a cycle triggers a visible warning banner and a best-effort fallback layout rather than a crash.
• Risk scoring is a heuristic, not a verified model—> see above.

Contributions on any of these are very welcome ==> see CONTRIBUTING.md.

Contributing

Contributions are welcome, from a typo fix to a full scanner adapter. Start here:

1. Read CONTRIBUTING.md, it covers local setup, what to prioritize (scanner adapters and layout scaling are the biggest gaps right now), and one important ground rule: if you add a score or prediction, document what it can and can't tell the user, the same way the existing risk score is documented above.
2. Check open issues for something to pick up, or open a new one to propose an idea before writing a lot of code.
3. Fork, branch, and open a PR. Small, focused PRs are easier to review than large ones.

If you find a security issue in the tool itself, see the Security section of CONTRIBUTING.md rather than opening a public issue with exploit details.

License

MIT