Attack Path Visualization

An attack path is the sequence of steps an attacker takes to exploit security weaknesses — from an initial point of entry to the ultimate target. The path is displayed as a node-graph, with each node representing an exploitable step, its role in the attack, and the misconfigurations or vulnerabilities it exposes.

My role As product designer at ARMO, I conceptualized, designed, and contributed to the implementation of the Attack Path feature — working closely with cross-functional teams to keep user-centric design principles at the forefront.

ARMO users

• New users are presented with an overwhelming amount of information.
• Users who want to improve security don't know what action would have the most impact.

General users

• Hundreds of cyber attacks per minute create massive amounts of intelligence to sift through.
• Whatever solution a business chooses, it can drown in signal without a way to prioritize.

• Help users understand all the ways attackers can exploit their environment.
• Show what to do right away to break the attack path.
• Help prioritize issues by security-posture impact.
• Give users a clearer view of their Kubernetes exposure level.

Jobs to be done

• When I sign up, I want to see the attack paths so I can fix what matters most first.
• When I review one, I want full context so I can understand why it's risky.
• When a new attack path arises, I want to be notified immediately.

User interviews We spoke in depth with DevOps and DevSecOps practitioners about their daily workflows and security concerns.

Competitive analysis We examined similar tools to identify opportunities to differentiate the Attack Path feature.

Prototyping & testing Prototypes went in front of users at multiple stages, shaping the final design.

We prioritized clarity and empowerment. Each node makes its role in the attack legible; each edge suggests where to intervene.

The final layout supports branching, provides clear success and empty states, and maps the end-to-end user flow.

The Attack Path graph is a visual way for users to see the route an attacker can take to infiltrate their Kubernetes environment. Readability, size, and contrast are as critical as the data itself.

Next steps

• Improving existing attack paths and developing new ones.
• Analyzing usage data to inform further improvements.
• Establishing a design system for consistent UI.