Attack paths
Trace what the internet can reach, hop by hop
Tracix builds a security graph from your Kubernetes objects, service traces, observed network flows and cloud inventory, and marks what the internet can reach. Pick a workload to see everything it could reach next, with the evidence behind every hop.
- Kubernetes · traces · flows · cloud
- Blast radius up to 6 hops
- Feasibility and confidence per hop
How it works
From the data you collect to the paths it implies
The graph is built from telemetry your collectors already send, so it shows connections that happened, not only those a diagram says should exist.
- 01ConnectKubernetes objects, traces, network flows and cloud inventory come from the collectors you already run.
- 02BuildTracix links workloads, images, services and cloud resources, and marks what the internet reaches.
- 03Pick an originChoose a workload, service, image or host, and see everything it reaches within six hops.
- 04Check each hopSee how easy each step is, whether traffic was observed, and the evidence behind it.
Scoring
Two scores on every hop, never blended
A path is only as strong as the evidence for each step. Tracix scores how easy each hop is for an attacker separately from how sure it is that the hop exists, and shows you both.
Feasibility
How easy the step is. A flow your collectors observed scores higher than a rule that only permits it.
Confidence
Whether Tracix believes the edge exists at all, shown apart from feasibility.
Observed or permitted
Observed flows draw solid lines. Rules open to the internet that no traffic confirmed draw dashed ones.
Evidence per hop
Select a hop to see its relation, where it came from and both scores.
History
See what was reachable before you fixed it
Edges that stop being observed are closed rather than deleted. Step back through the last 12 days to see the graph as it stood, and compare it with now.
- Drag the time scrubber and the graph reshapes to the edges valid at that moment
- Diff against now to see which connections have closed since
- Closed edges keep their history, so a past exposure stays explainable
Better together
Paths follow the data your other teams already use
The graph reads the same Kubernetes, flow and cloud data as your operators, so an exposure leads straight back to the workload, the connection or the rule behind it.
- Kubernetes and containersWorkloads, their images, Ingresses and load balancers come from the same cluster data your operators use.Learn more
- Cloud network monitoringeBPF flows show which workloads actually talk, so the graph follows connections that happened.Learn more
- Cloud security postureProwler checks find the misconfigurations behind a rule that leaves a resource open.Learn more
Data sources
What each source adds to the graph
The graph is only as complete as the data behind it. Each source adds its own nodes and edges, and a missing source leaves its part of the picture empty.
| Source | What it adds | Collected by |
|---|---|---|
| Kubernetes objects | Workloads, the images they run, and the Ingresses and LoadBalancer Services that expose them | The collector's Kubernetes integration |
| Traces | Which service each workload runs, from the last 7 days of spans | APM, from OpenTelemetry traces |
| Network flows | Connections between workloads observed in the last 7 days | Cloud network monitoring, with eBPF |
| Cloud inventory | Public IP addresses, and security groups, network security groups and firewall rules open to the internet on AWS, Azure and Google Cloud | Cloud discovery |
Tracix does not scan or probe anything to build the graph. It reads what these sources have already sent.
Does Tracix know which assets matter most?
How often is the graph rebuilt?
Does Tracix scan or probe my network?
What if a source is missing?
See what your workloads can reach
Connect your clusters, traces and cloud accounts, build the security graph and pick a workload to see its blast radius.