XM Cyber: Attack Path Management and Breach and Attack Simulation

Before “exposure management” was a category analysts wrote reports about, XM Cyber was already doing something adjacent to it under a different name: attack path management. That history shows in the product – it’s less a vulnerability aggregator and more a continuous, automated red team.

What is XM Cyber?

XM Cyber (now owned by Schneider Electric, following its earlier acquisition by CyberArk-adjacent investors) continuously simulates attacker techniques across on-prem, cloud, and hybrid environments without touching production systems the way a real red team engagement would. It builds a live graph of every possible route from an entry point to a critical asset, then ranks the individual chokepoints – not just individual vulnerabilities – that would break the most attack paths if fixed.

Key features

• Continuous attack path simulation – runs automatically and continuously rather than as a periodic pentest snapshot.
• Chokepoint prioritisation – ranks remediation not by CVE severity but by how many attack paths a single fix would eliminate.
• Hybrid coverage – on-prem AD, cloud (AWS/Azure/GCP), Kubernetes, and identity providers are all modelled in the same graph.
• Attack Path Management for specific frameworks – includes modelling tuned to ransomware and specific known adversary tradecraft (MITRE ATT&CK mapped).
• Purple team validation – safe, non-destructive simulation of specific attack techniques to validate whether existing controls would actually catch them.

Who it’s for

Security teams that already have a decent vulnerability management programme but are struggling with prioritisation – too many “critical” findings, not enough context on which ones an attacker could actually chain together. It’s also a strong fit for teams that want continuous validation of detection and response controls, not just a list of gaps.

XM Cyber vs the alternatives

Against Tenable One and Cymulate, XM Cyber’s differentiator is the graph-first, chokepoint-led model rather than a scoring formula bolted onto scan results – it was built around attack path simulation from day one rather than added to an existing vulnerability scanner. It generally complements, rather than replaces, a vulnerability scanner, since it needs vulnerability and configuration data as an input to build its graph.

Getting started

XM Cyber is typically sold as an enterprise deployment with professional services involved in the initial environment mapping – request a proof of concept scoped to a specific business unit or attack scenario (e.g. “path to our crown-jewel database”) rather than trying to model the entire estate on day one.