Design an Attack Path Analysis Engine
Last updated: December 9, 2025
Quick Overview
Design a system that automatically discovers and visualizes potential attack paths from initial entry points to high-value targets in a cloud environment.
Wiz
December 9, 20256
9
1,822 solved
Design a system that automatically discovers and visualizes potential attack paths from initial entry points to high-value targets in a cloud environment.
Attack path analysis is one of Wiz's most valued features. Instead of presenting thousands of individual findings, the system connects the dots to show how an attacker could chain vulnerabilities, misconfigurations, and permissions to reach critical assets. This transforms raw security data into actionable intelligence.
What the Interviewer Expects
- Model attack paths as directed graphs from entry points to targets
- Define and identify entry points (internet exposure, compromised credentials) and targets (sensitive data, admin access)
- Implement efficient path-finding algorithms on large security graphs
- Rank attack paths by exploitability and impact
- Visualize paths in a way that's actionable for security teams
Key Topics to Cover
How to Approach This
- Start by clarifying functional and non-functional requirements with the interviewer.
- Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
- Draw a high-level architecture first, then deep dive into 1-2 critical components.
- Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
- Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
- How do you handle the exponential number of possible paths in a large graph?
- How would you validate whether a theoretical attack path is actually exploitable?
- How do you update attack paths incrementally when the graph changes?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice System Design ProblemsSample Answer
Requirements
Functional Requirements
- Entry Point Identification: Automatically detect entry points like internet-exposed services and potential compromised credentials.
- Path Discovery: Model and ...
Capacity Estimation
Assuming Wiz operates in a cloud environment with:
- 10,000 nodes (servers, databases, etc.)
- 50,000 connections (network links between nodes)
- 1,000 unique entry points (exposed service...
Submit Your Answer
