The Problem
Vulnerability lists and identity issues live in separate silos — nobody can see that an internet-exploitable box sits one hop from a crown-jewel server. Teams drown in thousands of findings with no sense of which chain actually gets an attacker to the crown jewels.
What It Does
Fenrir chains exploitability × identity × reachability into ranked, breakable attack paths. It correlates exploitable and weak-auth footholds, same-subnet lateral movement (with credential pivots), and high-value crown-jewel targets (ACR ≥ 7) — then ranks every path by risk, so the first chain you break is the one that matters most.
Key Capabilities
- Foothold detection — flags every asset an attacker could enter through: CISA-KEV/critical vulns, SSH password auth, default or blank credentials.
- Reachability via /24 subnet adjacency — maps which footholds sit within reach of which targets.
- Credential-pivot boost — paths where reused/weak credentials let an attacker hop between hosts rank higher.
- Path risk score — combines target ACR, entry strength, pivot potential, and KEV status into one number per path.
- 3-stage path table — every chain laid out entry → pivot → target.
- Gated "Attack Path" tags + CSV export — endpoints become human-approved Entry/Target tags and worklists.
How It Works
Runs against the local navi.db built from your Tenable data: the vulns table (KEV cross-references, severity, plugins) and the assets table (IP, ACR). All writes are proposed, human-approved, and logged.
Who It's For
SOC and threat-led vulnerability teams; red and purple teams validating paths; CISOs who need exposure reporting that shows the chain and how it was broken.
Proof Points
In a 268-asset reference environment, Fenrir mapped 156 exploitable / weak-auth entry points, 67 crown-jewel targets (ACR ≥ 7), and 63 reachable attack paths connecting them — a ranked worklist instead of a wall of findings. Reachability is inferred, not observed.
Works Better With
Consumes Laelaps (KEV exploitability), Janus (credential weaknesses, identity pivots), Anubis (crown-jewel ACR), and Charon/Mimir (exploitable and EOL software) — the pack's correlation payoff in one view.
Why It's Different
- Four signals, one list — exploitability, credentials, criticality, and software risk compound instead of competing.
- Honest about reachability — paths are inferred from subnet adjacency and credential signals, not observed traffic, and Fenrir says so.
- Ranked by shared ACR — "crown jewel" means what your business says it means.
- Gated, reviewable writes — Fenrir proposes tags; a human approves.