Introduction

Attack path management has historically focused on identity systems like Active Directory and Entra ID. That focus made sense. These systems define authentication, authorization, and privilege at scale, and they remain central to how access is granted across an environment. But they are not the full picture. There are entire classes of systems that introduce attack paths that do not exist in the directory.

Device management platforms are one of the most important examples. These systems are responsible for managing endpoints at scale, deploying software, enforcing configuration, and executing administrative actions across entire fleets of devices. In practice, that means they can often execute code directly on managed systems. From an attacker’s perspective, that capability is significant. Control of a device management platform can allow an attacker to execute arbitrary code across endpoints, even when they do not otherwise have a path to those systems through traditional directory relationships.

The same dynamic exists in macOS environments. Organizations with significant macOS deployments rely on platforms like Jamf to manage and control their endpoints. These platforms introduce their own set of attack paths; paths that historically have not been visible in directory-focused analysis. This has created a gap. Organizations with macOS-heavy or macOS-first environments have had limited ways to model how control propagates across their systems.

Even in mixed environments, critical portions of the attack surface have remained unmodeled simply because they exist outside of the directory.