sg-deceptive-reachability-auditor

To find hidden lateral movement paths in AWS security groups, you must map the directed reachability graph by composing SG-to-SG ingress references and instance memberships. This exposes multi-hop chains from internet-facing entry points to crown-jewel database tiers that isolated single-rule reviews miss.

Your AWS security group audit likely misses deep lateral movement chains because it evaluates rules in isolation rather than computing the transitive closure of a directed reachability graph. Long 4-6 hop reference chains buried across multiple security groups remain invisible without graph composition.

To audit AWS security groups for pivot hubs and chokepoints, you build a directed reachability graph from UserIdGroupPairs and identify high-severity hub security groups that bridge otherwise-isolated reachable regions. This reveals quiet chokepoints that per-rule reads fail to detect.

Yes, you can detect lateral movement in segmented or orphaned AWS fleets by computing the directed reachability graph of security group references. The graph correctly reports no reachable path on disconnected or disjoint fleets without fabricating exposure from broken deep chains.

The limitations of using security group graphs for reachability audits include the inability to evaluate live host membership, route tables, NACLs, and application-layer authentication. The SG graph stops answering questions beyond the boundary of ingress rule composition and instance membership.

To audit a production AWS fleet for multi-hop lateral movement, you compose security group ingress rules and instance membership into a directed reachability graph. This enumerates every reachable tier from named entry points and flags 4-6 hop lateral movement chains as critical findings with exact hop lists.