Contextual weakness scoring during network penetration testing

1 . A method for contextual weakness scoring, comprising:

executing an autonomous penetration test of a network comprising a plurality of network assets, the plurality of network assets comprising a first network asset and one or more additional network assets that are downstream from the first network asset within one or more attack paths of the autonomous penetration test, wherein executing the autonomous penetration test comprises:

gaining unauthorized access to the first network asset; and

gaining unauthorized access to the one or more additional network assets based at least in part on gaining unauthorized access to the first network asset;

generating, as part of the autonomous penetration test, respective scores for the first network asset and the one or more additional network assets, wherein a first respective score for the first network asset is based at least in part on a first weakness score of the first network asset and on one or more additional weakness scores corresponding to the one or more additional network assets that are downstream from the first network asset in accordance with identifying the one or more additional network assets within a first attack path and a second attack path of the one or more attack paths, wherein the first attack path is from the first network asset to a second network asset of the one or more additional network assets, and wherein the second attack path is from the first network asset to a third network asset of the one or more additional network assets; and

outputting, based at least in part on the autonomous penetration test, a ranking of the plurality of network assets based at least in part on the respective scores.

2 . The method of claim 1 , further comprising:

modeling the first attack path of the one or more attack paths from the first network asset to the second network asset of the one or more additional network assets;

modeling the second attack path of the one or more attack paths from the first network asset to the third network asset of the one or more additional network assets; and

generating a representation of the one or more attack paths comprising at least the first attack path and the second attack path, wherein the representation indicates the one or more additional network assets that are downstream from the first network asset.

3 . The method of claim 2 , wherein the first attack path, the second attack path, the representation, or any combination thereof are modeled as directed acyclic graphs (DAGs).

4 . The method of claim 2 , further comprising:

identifying the one or more additional network assets that are downstream from the first network asset using the representation of the one or more attack paths, wherein the first respective score is generated for the first network asset based at least in part on the one or more additional weakness scores after identifying the one or more additional network assets.

5 . The method of claim 1 , wherein the first weakness score and the one or more additional weakness scores are based at least in part on a common vulnerabilities and exposures (CVE) database.

6 . The method of claim 1 , wherein the first respective score comprises a combination of the first weakness score of the first network asset and a summation of the one or more additional weakness scores corresponding to the one or more additional network assets that are downstream from the first network asset.

7 . The method of claim 1 , wherein the first respective score comprises a combination of the first weakness score of the first network asset and a maximum weakness score of the one or more additional weakness scores corresponding to the one or more additional network assets.

8 . The method of claim 1 , wherein the first respective score is based at least in part on a quantity of the one or more additional network assets that are downstream from the first network asset.

9 . The method of claim 1 , further comprising:

receiving, prior to executing the autonomous penetration test, one or more client-specific tags that indicate one or more respective priority levels of one or more respective network assets within the network, wherein the respective scores are generated in accordance with the one or more respective priority levels of the one or more respective network assets.

10 . The method of claim 9 , wherein generating the first respective score comprises:

generating an initial score of the first network asset based at least in part on the first weakness score of the first network asset and on the one or more additional weakness scores corresponding to the one or more additional network assets; and

increasing the initial score to generate the first respective score of the first network asset based at least in part on the one or more client-specific tags that indicate a priority level above a threshold priority level for the first network asset.

11 . The method of claim 9 , wherein generating the first respective score comprises:

generating an initial score of the first network asset based at least in part on the first weakness score of the first network asset and on the one or more additional weakness scores corresponding to the one or more additional network assets; and

decreasing the initial score to generate the first respective score of the first network asset based at least in part on the one or more client-specific tags that indicate a priority level below a threshold priority level for the first network asset.

12 . The method of claim 1 , further comprising:

obtaining, after generating the respective scores, one or more client-specific tags that indicate one or more respective priority levels of one or more respective network assets within the network;

modifying the respective scores based at least in part on the one or more client-specific tags, wherein the modifying comprises increasing or decreasing one or more scores of the respective scores in accordance with the one or more respective priority levels; and

outputting a modified ranking of the plurality of network assets based at least in part on the modified respective scores.

13 . The method of claim 1 , wherein the plurality of network assets comprises a critical infrastructure compromise, a domain compromise, a domain user compromise, a host compromise, a perimeter breach, a sensitive data exposure, a brand compromise, a ransomware exposure, a cloud service compromise, a cloud compromise, a business email compromise, a user or role compromise, a full account compromise, a directory user compromise, a full tenant compromise, a third-party user compromise, or any combination thereof.

14 . The method of claim 1 , wherein the respective scores are generated in real-time during the autonomous penetration test.

15 . The method of claim 1 further comprising:

gaining, during the autonomous penetration test and after generating the first respective score for the first network asset, unauthorized access to a third network asset that is downstream from the first network asset; and

generating an updated first respective score for the first network asset based at least in part on a third weakness score of the third network asset.

16 . An apparatus for contextual weakness scoring, comprising:

one or more memories storing processor-executable code; and

one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:

execute an autonomous penetration test of a network comprising a plurality of network assets, the plurality of network assets comprising a first network asset and one or more additional network assets that are downstream from the first network asset within one or more attack paths of the autonomous penetration test, wherein, to execute the autonomous penetration test, the one or more processors are individually or collectively operable to execute the code to cause the apparatus to:

gain unauthorized access to the first network asset; and

gain unauthorized access to the one or more additional network assets based at least in part on gaining unauthorized access to the first network asset;

generate, as part of the autonomous penetration test, respective scores for the first network asset and the one or more additional network assets, wherein a first respective score for the first network asset is based at least in part on a first weakness score of the first network asset and on one or more additional weakness scores corresponding to the one or more additional network assets that are downstream from the first network asset in accordance with identifying the one or more additional network assets within a first attack path and a second attack path of the one or more attack paths, wherein the first attack path is from the first network asset to a second network asset of the one or more additional network assets, and wherein the second attack path is from the first network asset to a third network asset of the one or more additional network assets; and

output, based at least in part on the autonomous penetration test, a ranking of the plurality of network assets based at least in part on the respective scores.

17 . The apparatus of claim 16 , wherein the one or more processors are individually or collectively further operable to execute the code to cause the apparatus to:

model the first attack path of the one or more attack paths from the first network asset to the second network asset of the one or more additional network assets;

model the second attack path of the one or more attack paths from the first network asset to the third network asset of the one or more additional network assets; and

generate a representation of the one or more attack paths comprising at least the first attack path and the second attack path, wherein the representation indicates the one or more additional network assets that are downstream from the first network asset.

18 . The apparatus of claim 17 , wherein:

the first attack path, the second attack path, the representation, or any combination thereof are modeled as directed acyclic graphs (DAGs).

19 . The apparatus of claim 17 , wherein the one or more processors are individually or collectively further operable to execute the code to cause the apparatus to:

identify the one or more additional network assets that are downstream from the first network asset using the representation of the one or more attack paths, wherein the first respective score is generated for the first network asset based at least in part on the one or more additional weakness scores after identifying the one or more additional network assets.

20 . A non-transitory computer-readable medium storing code for contextual weakness scoring, the code comprising instructions executable by one or more processors to:

execute an autonomous penetration test of a network comprising a plurality of network assets, the plurality of network assets comprising a first network asset and one or more additional network assets that are downstream from the first network asset within one or more attack paths of the autonomous penetration test, wherein the instructions to execute the autonomous penetration test are executable to:

gain unauthorized access to the first network asset; and

gain unauthorized access to the one or more additional network assets based at least in part on gaining unauthorized access to the first network asset;

generate, as part of the autonomous penetration test, respective scores for the first network asset and the one or more additional network assets, wherein a first respective score for the first network asset is based at least in part on a first weakness score of the first network asset and on one or more additional weakness scores corresponding to the one or more additional network assets that are downstream from the first network asset in accordance with identifying the one or more additional network assets within a first attack path and a second attack path of the one or more attack paths, wherein the first attack path is from the first network asset to a second network asset of the one or more additional network assets, and wherein the second attack path is from the first network asset to a third network asset of the one or more additional network assets; and

output, based at least in part on the autonomous penetration test, a ranking of the plurality of network assets based at least in part on the respective scores.