From Isolated Finding to Defensible Path

This comparison distinguishes between an isolated finding and a defensible attack path. A single finding may indicate risk, but by itself it does not establish how an adversary could move through a system or what outcome would follow. A defensible path requires observed or reproduced entry, a supported transition order, evidence tied to each step, and a bounded consequence with explicit validation state. The comparison also clarifies its limits: not every finding should be promoted into a path, and a path diagram is not proof of exploitation.