Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point

Introduction

Security teams have gotten pretty good at testing against what can hurt them. Can this EDR agent catch this payload? Will my organization fail the phishing simulation? Does this SIEM rule fire on this particular technique? And, in more mature organizations, this testing happens continuously rather than as a one-off exercise.

But no matter how much you validate against these individual techniques, the article argues, you may still be missing the bigger picture. Attackers rarely rely on a single technique in isolation. Instead, they chain together multiple steps—each potentially undetectable on its own—to achieve their objectives. A payload that evades an EDR, a credential that slips past MFA, or a log entry that slips under a SIEM rule might seem harmless in isolation, but when combined with other techniques, they can form a complete attack path.

The piece emphasizes that modern adversaries operate with patience and precision, mapping out environments and stitching together legitimate-looking actions that collectively constitute a threat. Security controls are often designed and tested against known techniques, but the integration of those techniques across different layers of the defense stack is where gaps emerge. This is particularly relevant for frameworks like MITRE ATT&CK, where the framework's structure encourages thinking about techniques individually rather than as interconnected steps.

The article does not describe a specific new vulnerability or threat actor activity. Rather, it calls for a strategic shift in how security programs validate their defenses—moving from point-product testing toward holistic, continuous attack-chain emulation that mirrors real-world adversary behavior.