Reachability and Flow Routes

Watch · 1:26What can reach your crown jewels?

Watch · 2:53Assume breach: what can an attacker reach from here?

The Reachability tab helps you see how data moves through your model toward the things you care about most, and which threats sit along the way. Pick an origin and the tab traces the flow routes — directed paths that follow your modeled data flows — to your crown jewels, or between any two elements you choose. For each route it shows you how many hops it takes, where it crosses a security boundary, what data sensitivity it carries, and the worst live threat sitting on it.

Before you read any of that, read this once: these are flow routes, not attack paths. The tab models your topology — how flows connect — and nothing about how hard a real attacker would work to traverse them. Used with that framing, it is a sharp tool for validating your segmentation intent and spotting surprises. Used as an attack-path predictor, it will mislead you and anyone you brief. The whole of How to Read This Correctly exists to keep you on the right side of that line, and the same caveat is printed at the top of the tab itself.

Three Ways to Trace

The tab opens on a short caveat line and a three-button toggle:

A faithful minimap of your model sits alongside all three modes. It paints the active route — or, in Blast radius, the whole reachable cone — so you can see it in the shape of your real diagram, and in Pick two it doubles as a way to choose your endpoints by clicking nodes.

Crown jewels come first. A crown jewel is a component you have flagged as a high-value asset (the crown toggle on a component's settings). If no component in the model is flagged, Crown-jewel reachability has nothing to rank — it tells you so and points you to Pick two, which traces routes between any elements regardless of flagging.

Crown-Jewel Reachability

This mode answers one question for every crown jewel in the model: starting from a chosen origin, is there a modeled flow route to it — and if so, how direct is it?

Choosing the origin

The From selector sets where routes start. It defaults to the model's external entry-points and lets you choose any single node instead.

"Assumed-breach" is a structural premise, not a verdict. Choosing a node as the origin does not say that node is weak, untrusted, or compromised. It is simply a what-if: start the trace here. The tab never makes a trust judgment about any node.

If the model has no external entities, the default origin has nothing to start from. The tab says so and invites you to pick a specific node as an assumed-breach origin instead.

Reading the per-jewel results

A summary line reports how many of your crown jewels are reachable from the chosen origin — for example 3 of 5 crown jewels reachable from external entry. Below it, each crown jewel appears as a row:

A jewel name is clickable — it opens that element's Component Profile. Reachable jewels also offer view strip (open the shortest route as a readable strip in Pick two) and show on map (paint the route on the minimap).

Read "no modeled flow route" as exactly that — a statement about the model, not a guarantee. It means the diagram contains no directed chain of data flows from the origin to this jewel. It does not mean the asset is segmented, isolated, or safe. The most common cause is an incomplete model. When a count reads 0 reachable, the tab deliberately labels it a modeled-topology gap and points you to the report's scope banner — never a reassuring green.

Tracing onward, step by step

Each node on a route carries an onward action. Clicking it re-anchors the origin to that node and recomputes the crown-jewel list from there. This lets you explore a model one step at a time — "starting from here, what's reachable next; and from there, what next" — without typing in new endpoints each time. It is a navigation aid for following the topology, nothing more.

Pick Two

Pick two enumerates the flow routes between any two elements you choose and renders one of them as a readable strip.

Choosing the endpoints

You have two ways to set the Origin and Target, and they stay in sync:

• The autocompletes. Type into the Origin and Target fields and choose from the list. Each is clearable.
• The minimap. Enlarge the map with its expand button (top-left corner), then click nodes directly: your first click sets the origin (it shows a dashed outline as a pending pick), the second sets the target, and a third click starts over. A reset selection link clears both.

The map hint below the minimap tells you which endpoint it's waiting for next.

Reading the route strip

Once both endpoints are set, the tab lists the routes it found, shortest first. Selecting a route draws it as a linear strip — like a transit line — that reads left to right from origin to target:

Each node also carries the same onward action as crown-jewel mode, so you can pivot from any point on a strip into a fresh trace.

When there are many routes — or none

Route enumeration is bounded: routes are simple paths (no node is visited twice), capped in length and in how many are collected. The tab is always honest about that boundary:

The hop limit is 6. It bounds enumeration, not reality: read "no routes" as "none within six hops," never as "no connection."

This banner is persistent — it stays on screen and travels into exports. The tab never silently truncates a route list.

Choke points — the node every route must pass through

Above the route list, whenever the target is reachable, Pick two answers the question the routes only imply: of all the ways from origin to target, which node does every one of them go through? That node is a choke point — controlling it severs every modeled flow route between the two. It is the defender's "where do I place one control" lever.

Two things make this trustworthy. First, it is computed by testing whether removing a node disconnects the target — not by intersecting the route list above — so it stays complete even when route enumeration is capped (the strip says so when that happens). Second, the caveat stays attached: a choke point sits on every modeled flow route only. Controlling it does not address unmodeled flows, shared credentials, or non-flow lateral movement, and "no single choke point" is not a verdict that the path is well-segmented. The number of choke points is never a risk score.

Blast Radius

Where the first two modes ask "which flow routes lead to a specific target?", Blast radius asks the containment question: if this one node were compromised, how much of the model is exposed? You pick a node — its assumed-breach origin — and the tab shows every component reachable from it by following modeled flows downstream.

Choosing the node and the scope

The Assume breached selector picks the origin node — or click any node directly on the minimap (enlarge it with ⤢ for easier clicks); clicking another node re-anchors the radius. A two-button toggle sets how far the radius extends:

The radius is forward only: it follows flow direction outward from the node to what its flows lead to, never backward toward it.

Reading the radius

A summary line reports the triage signals — for example Storefront reaches 5 of 6 other components · ⬢ 3 crown jewels in radius · worst in radius: Critical. Directly below it, a containment row lists the distinct trust boundaries the blast crosses — Crosses 2 trust boundaries: DMZ, App (each name clickable into its profile). If no modeled flow leaves the origin's own boundary, that row reads No modeled flow leaves its boundary — a containment signal, not a segmentation guarantee instead.

Below that, each reachable node is a row, ordered nearest-first:

The whole reachable cone is painted on the minimap at once, so you can see the spread in the shape of your real diagram.

An empty radius is a containment result, not a clean bill of health. If a node reaches nothing downstream, the tab says so plainly — and immediately adds that this is not a proof of isolation. Unmodeled flows, shared credentials, and non-flow vectors are all outside what this view can see. Read it as "no modeled flow spreads from here," never as "this node is safely contained." The blast radius is a reachability count, never a risk score.

The Minimap and the Route Legend

The minimap is a small, faithful copy of your hand-laid diagram — it uses your real layout, not an auto-generated one. It serves all three modes:

• Crown jewels are drawn in red and external entry-points in amber, so you can spot them at a glance.
• The active route is painted in cyan — both the nodes and the exact flow edges along it — so you can see the route in the context of the whole model.
• The expand button opens a larger, labeled view. In Pick two that enlarged map is the primary place to click your two endpoints.

A Route legend appears beneath the minimap in Pick two, decoding the strip's glyphs: the component and crown-jewel markers, the flow-name connector, the EXIT/ENTER crossing signs, the worst-threat dots from critical to low, and the data-sensitivity chips. The legend reuses the strip's own colors, so what you see in the legend matches the strip exactly. The shared minimap and sensitivity vocabulary are described once in Reading the Report.

How to Read This Correctly

This is the part to internalize before you brief anyone. The tab is a topological view. It tells you how your modeled data flows connect — and deliberately models nothing about attacker behavior.

Flow routes are not attack paths

A route here is a chain of modeled data flows, traced in the direction those flows run. It is not a sequence of exploits, and it makes no claim that an attacker could actually walk it. Two systems that exchange data are connected by a flow route whether or not that connection is exploitable.

A hop count is proximity, not effort

3 hops means three data-flow steps along the diagram. It does not mean three steps of attacker work, three vulnerabilities, or "easy." A three-hop route across hardened, well-controlled systems is harder to abuse than a one-hop route across an unpatched one — and the tab cannot tell the difference, because effort is not what it measures.

What the analysis does not model

The trace is purely structural. It does not account for:

• Credential reuse or token theft — moving by stealing an identity rather than by following a flow.
• Exploit chaining — stringing vulnerabilities together to pivot.
• Controls as obstacles — a route's hop count is unchanged by how well each node is defended.
• Trust levels — the origin set is external entities or a node you chose, never an "untrusted" classification.

The threat dots on a route tell you which modeled findings sit on those elements; they do not turn the route into an exploitability estimate.

"No modeled flow route" is not "safe"

This is the easiest claim to get wrong. An unreachable crown jewel means the model contains no directed flow chain to it — most often because the model is incomplete, not because the asset is isolated. Always check the report's scope banner alongside it. Never report an unreachable jewel as "segmented" or "protected."

Language to use with stakeholders

Say this: "In our model, customer records are reachable from external entry in two flow hops, crossing one boundary, with a high-severity finding on the route." This is precise and defensible.

Not this: "An attacker can reach customer records in two steps." That over-claims — it converts a modeling statement into an attack prediction the tool never made.

Common Uses

Within those limits, the tab earns its place in a review:

• Validate segmentation intent. You believe a sensitive store should only be reachable through a gateway. Set the store as a Pick two target (or check it in crown-jewel mode) and confirm every route passes through the boundary and node you expect. A route that skips them is a modeling finding worth investigating — either the model is wrong, or your segmentation is.
• Spot unexpectedly short routes to crown jewels. A crown jewel reachable from external entry in one hop is worth a second look. The hop count won't tell you it's exploitable, but a surprisingly direct modeled connection is exactly the kind of thing a design review should question.
• Find sensitive data crossing boundaries. Read the sensitivity chips and EXIT/ENTER signs along a route to see where Restricted or Confidential data leaves one boundary and enters another. That tells you where to focus controls and where to look harder in Boundary Crossings.
• Walk an assumed-breach what-if. Pick a node as the origin and use onward to step through what the topology connects to from there — a structured way to explore reach in the model, framed honestly as topology rather than prediction.
• Size a node's blast radius. Use Blast radius to ask the containment question directly: if this node fell, how many components — and which crown jewels — does a modeled flow reach from it? A surprisingly wide radius is a segmentation prompt; a narrow one is a containment signal (not a safety guarantee). Use set as origin to walk the spread node by node.

Next Steps

• Reading the Report — the shared minimap and data-sensitivity language, plus Boundary Crossings.
• Working with Findings — the Residual Risk ledger and the Component Profile that route elements drill into.
• Understanding Coverage — the Coverage & Gaps MITRE ATT&CK matrix.
• Getting Started — generate, refresh, and export the report.
• Guide Index — the full Threat Report documentation set.