Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point

Security teams have become proficient in testing their defenses against various threats, continuously validating their systems against specific techniques and payloads. They assess the effectiveness of their EDR agents, phishing simulations, and SIEM rules to identify potential vulnerabilities. However, this approach focuses on individual techniques rather than the overall attack chain. This method of testing may not provide a complete picture of an organization's security posture. The excerpt suggests that security teams may be missing the point by concentrating on individual techniques rather than examining the entire attack chain. This narrow focus may lead to a lack of understanding of how multiple techniques can be combined to launch a successful attack.