Proactive mitigation of dormant attack paths

1 . A method, comprising:

generating, by a device, variants of a cloud-native application, wherein the variants include modifications that introduce vulnerabilities that would be exploitable in the variants and not exploitable in the cloud-native application, and wherein generating the variants includes:

identifying, from an attack path input, potential vulnerabilities that need to be present for the attack path input to become exploitable, and

creating an instance of a variant of the cloud-native application by injecting the potential vulnerabilities into code of the cloud-native application;

identifying, by the device, attack paths in the variants that are exploitable based on the introduced vulnerabilities;

updating, by the device, an attack path knowledge base with the attack paths; and

preventing, by the device, changes to the cloud-native application in a production environment that would make one or more of the attack paths identified in the variants exploitable in the cloud-native application.

2 . The method of claim 1 , wherein generating the variants includes modifying deployment parameters of the cloud-native application to include attack paths that are activated with a configuration change.

3 . The method of claim 1 , wherein identifying the attack paths in the variants that are exploitable based on the introduced vulnerabilities includes instantiating the variants in a testing environment.

4 . The method of claim 3 , wherein identifying the attack paths in the variants that are exploitable based on the introduced vulnerabilities includes testing the variants by applying usage patterns and traffic flows derived from the production environment to the variants in the testing environment.

5 . The method of claim 3 , further comprising:

utilizing the variants instantiated in the testing environment to conduct one or more of evaluating automated vulnerability identification utilities or training a red team.

6 . The method of claim 1 , further comprising:

scanning the cloud-native application to determine whether the attack paths identified in the variants exist in the cloud-native application.

7 . The method of claim 1 , wherein preventing the changes includes providing the changes to a continuous integration and continuous delivery environment to automatically detect and block the changes that would make one or more of the attack paths exploitable in the cloud-native application.

8 . The method of claim 1 , further comprising:

utilizing generative artificial intelligence to replace sections of application code of the cloud-native application with versions that are susceptible to exploitation.

9 . The method of claim 1 , wherein the changes to the cloud-native application are prevented prior to the cloud-native application being deployed in the production environment.

10 . An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the one or more network interfaces and configured to execute one or more processes; and

a memory configured to store a process that is executable by the processor, the process, when executed, configured to:

generate variants of a cloud-native application, wherein the variants include modifications that introduce vulnerabilities that would be exploitable in the variants and not exploitable in the cloud-native application, and wherein to generate the variants includes to utilize generative artificial intelligence to replace sections of application code of the cloud-native application with versions that are susceptible to exploitation;

identify attack paths in the variants that are exploitable based on the introduced vulnerabilities;

update an attack path knowledge base with the attack paths; and

prevent changes to the cloud-native application in a production environment that would make one or more of the attack paths identified in the variants exploitable in the cloud-native application.

11 . The apparatus as in claim 10 , wherein the process when executed is further configured to:

generate the variants by modifying deployment parameters of the cloud-native application to include attack paths that are activated with a configuration change.

12 . The apparatus as in claim 10 , wherein the process when executed is further configured to:

identify, from an attack path input, potential vulnerabilities that need to be present for the attack path input to become exploitable; and

create an instance of a variant of the cloud-native application by injecting the potential vulnerabilities to code of the cloud-native application.

13 . The apparatus as in claim 10 , wherein the process when executed is further configured to:

identify the attack paths in the variants that are exploitable based on the introduced vulnerabilities by instantiating the variants in a testing environment.

14 . The apparatus as in claim 13 , wherein the process when executed is further configured to:

identify the attack paths in the variants that are exploitable based on the introduced vulnerabilities by testing the variants in the testing environment by applying usage patterns and traffic flows derived from the production environment to the variants.

15 . The apparatus as in claim 13 , wherein the process when executed is further configured to:

utilize the variants instantiated in the testing environment to conduct one or more of evaluating automated vulnerability identification utilities or training a red team.

16 . The apparatus as in claim 10 , wherein the process when executed is further configured to:

scan the cloud-native application to determine whether the attack paths identified in the variants exist in the cloud-native application.

17 . The apparatus as in claim 10 , wherein the process when executed is further configured to:

prevent the changes by providing the changes to a continuous integration and continuous delivery environment to automatically detect and block the changes that would make one or more of the attack paths exploitable in the cloud-native application.

18 . A tangible, non-transitory, computer-readable medium having computer-executable instructions stored thereon that, when executed by a processor on a computer, cause the computer to perform a method comprising:

generating variants of a cloud-native application, wherein the variants include modifications that introduce vulnerabilities that would be exploitable in the variants and not exploitable in the cloud-native application, and wherein generating the variants includes utilizing generative artificial intelligence to replace sections of application code of the cloud-native application with versions that are susceptible to exploitation;

identifying attack paths in the variants that are exploitable based on the introduced vulnerabilities;

updating an attack path knowledge base with the attack paths; and

preventing changes to the cloud-native application in a production environment that would make one or more of the attack paths identified in the variants exploitable in the cloud-native application.

19 . The tangible, non-transitory, computer-readable medium as in claim 18 , wherein generating the variants includes:

identifying, from an attack path input, potential vulnerabilities that need to be present for the attack path input to become exploitable viable, and

creating an instance of a variant of the cloud-native application by injecting the potential vulnerabilities into code of the cloud-native application.

20 . The tangible, non-transitory, computer-readable medium as in claim 18 , wherein identifying the attack paths in the variants that are exploitable based on the introduced vulnerabilities includes instantiating the variants in a testing environment.