Every cloud security dashboard has more findings than your team will ever fix. The question that matters isn't "how many alerts." It's "which 10 fixes close the most attack paths."
This is how we build an Exposure Kill List during a CompliTru engagement — the ranked, dependency-aware fix sequence that turns 500 alerts into 10 actions.
Why most cloud security backlogs grow forever
A typical mid-market AWS environment scans clean against the CIS Foundations Benchmark and still has 500+ findings. The math:
- 50–80 findings per AWS account from a CSPM scan
- 5–15 accounts in a typical Organization
- ×3 multiplier from compliance framework overlap (SOC 2 + NIST + ISO finding the same thing in different language)
The average team works the backlog FIFO ranked by severity. After 6 months of work, the backlog is bigger than when they started. New findings come in faster than old ones close, because the team is fixing low-blast-radius items first (they're easier).
The Exposure Kill List inverts this. Rank by attack value, not severity score.
What "attack value" actually means
A finding's attack value is a function of three independent things:
- Exploitability. Is there a public CVE? Is there an exploit POC? How weaponized is the vector?
- Reachability. Can an external attacker reach this resource? What's the path? How many hops?
- Sensitivity. What does the resource hold or have access to? PII? Production credentials? Database?
A Critical CVE on a private subnet with no public path and no sensitive data has lower attack value than a Medium misconfiguration on a public-facing service one hop from your customer database.
The 5-step process
Step 1: Public surface inventory (Day 1)
What an attacker sees from outside your environment:
- Every EC2 instance with a public IP
- Every Application/Network/Classic Load Balancer
- Every API Gateway with a public endpoint
- Every Lambda Function URL
- Every CloudFront distribution and origin
- Every S3 bucket with public read or public write
- Every RDS / DocumentDB / OpenSearch with public accessibility
- Every Route 53 record pointing externally
- Every public ECR repository
- Every public AMI shared
For each public-facing resource, capture: - Hostname / IP / domain - TLS configuration (cert validity, cipher suites, HSTS) - Open ports and listening services - Service banner / fingerprint - WAF / Shield protection status
This is the attacker's inventory of you. We typically find 30–80 unique public surfaces per environment.
Step 2: Reachability graph (Day 2)
For each public surface, map what's behind it:
- VPC / subnet / security group
- IAM role attached to the resource (and what that role can do)
- Network paths to internal services (security group references, peering, transit gateways)
- Service-to-service IAM relationships (which roles can assume which other roles)
Output: a directed graph where nodes are AWS resources and edges are "can reach" or "can assume." Most environments have:
- 30–80 public entry points
- 200–600 internal reachable resources from at least one entry point
- 50–100 IAM escalation edges
The graph is the foundation. Without it, you can't compute attack paths.
Step 3: Sensitivity classification (Day 3)
Tag every resource in the graph with a sensitivity score:
- Tier 0 (Crown jewel): customer data, PII, PHI, payment data, source code, production credentials.
- Tier 1 (High): internal databases, secrets stores, IAM administrative roles, KMS keys for Tier 0 data.
- Tier 2 (Medium): internal services that depend on Tier 0/1 (caches, queues touching sensitive data).
- Tier 3 (Low): infrastructure with no sensitive data and no path to it.
Tagging is part discovery, part interview. Engineering teams know what they store; security teams rarely do at the resource level. Plan for 2–3 hours of conversation across the engineering org during this step.
Step 4: Attack path enumeration (Day 4)
For each Tier 0 resource, walk back through the graph to every public entry point. The shortest path with the lowest-friction edges is the most likely attack path.
A real attack path from a CompliTru engagement (anonymized):
1. Public ALB with TLS 1.0 enabled and no WAF
2. ↓ routes to ECS service running an open-source CMS with known RCE in older version
3. ↓ ECS task role has s3:GetObject on internal-config-bucket
4. ↓ internal-config-bucket holds RDS master credentials in plaintext
5. ↓ RDS holds 4M customer records with PII
5-step path. Every step is a "Medium" or lower individual finding. Together they're a breach path.
The Kill List ranks paths by: - Number of Tier 0 resources reachable - Path length (shorter = easier to exploit) - Edge weakness scores (CVE on entry point, weak IAM trust on a hop, plaintext secret at the end)
Step 5: The Kill List itself (Day 5)
The Kill List is NOT just the worst paths. It's the set of fixes that, if applied, close the most paths simultaneously.
Example: if 8 attack paths all flow through the same internal-config-bucket with plaintext secrets, fixing that ONE bucket (encryption + KMS + IAM tightening) closes 8 paths. That's a higher-leverage fix than patching the CMS RCE on one ALB, even though the CMS RCE is a worse individual finding.
The output of an Exposure Kill List engagement is typically: - 8–15 ranked fixes - Each fix maps to N attack paths it closes - Each fix has a remediation effort estimate (hours, dependencies, rollback plan) - Each fix has a controlling owner (which team executes)
A team working a Kill List sequentially closes more attack value in 2 weeks than they did in 6 months working FIFO on individual findings.
What the Exposure Kill List sprint delivers
CompliTru's Exposure Kill List & Rapid Patch sprint runs the 5-step process in 1 week. $12K for the assessment + Kill List delivery. Optional remediation window after assessment for $8K–$15K, where we work hands-on with your engineering team to close the top fixes.
What you receive: - Public surface inventory (every resource an attacker can see) - Reachability graph (every internal resource one hop or more from external) - Tier 0/1/2/3 sensitivity classification of every resource - 8–15 ranked attack paths with full step-by-step explanations - The Kill List — high-leverage fixes ranked by paths closed per unit of effort - Per-fix remediation runbooks ready for your engineering team
Mistakes to avoid
1. Treating CVE severity as attack value.
A Critical CVE on a private resource with no path is lower attack value than a Medium misconfiguration on the front door. CVSS scoring is environment-blind. Your environment has context. Use it.
2. Confusing CSPM coverage with attack-path coverage.
A CSPM finds 500 individual misconfigurations. It rarely finds the 8 attack paths those misconfigurations form. The graph step is what produces the path view.
3. Buying a tool before doing the assessment.
Most teams buy a CSPM, then realize they need a CIEM, then realize they need an attack-path graph tool. The pattern is backwards. Do one good Kill List assessment first. Then you know what tooling actually closes your paths.
4. Closing only the worst-individual finding.
The worst-CVSS finding closes one path. The unsexy "encrypt the bucket and tighten the IAM trust" closes eight. Always optimize for paths-closed-per-fix, not severity-of-fix.
When to run a Kill List
Run an Exposure Kill List assessment when: - You have a CSPM but no clear remediation priority - Your security team is overwhelmed by alert volume but the executive team is asking "what should we fix first" - You're prepping for a board-level security review and need a defensible "top risks" list - You've inherited an environment via M&A and need a fast read on the actual exposure
Run a CompliTru Exposure Kill List Sprint when you want this delivered in 5 working days with the optional rapid-patch window included. $12K assessment + $8K–$15K remediation. Read more at services.complitru.ai or book a 15-min scoping call.
Related sprints: - Network Segmentation & Blast Radius Reduction — close attack paths at the network layer, $12K–$20K - IAM Least-Privilege & CIEM Sprint — close attack paths at the identity layer, $12K–$18K - Secretless CI/CD Sprint — close one of the most common attack-path entry points, $15K–$22K
Free starting point: Free AWS Credential Scan — initial public surface inventory in 10 minutes.