Dynamic prioritization of attack paths in cloud native application

A system comprising:

• one or more processors;
• and
• one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• identifying components of a cloud native application and connections between the components;
• analyzing at least the components and connections of the cloud native application to identify a set of attack paths that are security vulnerabilities for the cloud native application;
• monitoring network communications in the connections between the components;
• collecting, based at least in part on the monitoring of the connections, metrics representing signals in the network communications that indicate real-time security vulnerabilities;
• identifying a first subset of the attack paths based at least in part on a first portion of the metrics corresponding to the first subset of attack paths indicating a real-time security vulnerability;
• and
• prioritizing the first subset of the attack paths over a second subset of the attack paths based at least in part on the first subset of the attack paths having the first portion of the metrics indicating real-time security vulnerabilities.

One or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors to perform operations comprising:

• identifying components of a cloud native application and connections between the components;
• analyzing at least the components and connections of the cloud native application to identify a set of attack paths that are security vulnerabilities for the cloud native application;
• monitoring network communications in the connections between the components;
• collecting, based at least in part on the monitoring of the connections, metrics representing signals in the network communications that indicate real-time security vulnerabilities;
• identifying a first subset of the attack paths based at least in part on a first portion of the metrics corresponding to the first subset of attack paths indicating a real-time security vulnerability;
• and
• prioritizing the first subset of the attack paths over a second subset of the attack paths based at least in part on the first subset of the attack paths having the first portion of the metrics indicating real-time security vulnerabilities.