Security researcher, TED speaker, and self-described friendly hacker Keren Elazari has a trick she’s pulled on more security programs than she can count. And it takes nothing more than a cup of coffee and five minutes with someone who works there.

When I had Keren on The Segment podcast, she told me how it usually goes. Leadership walks her through a security program that looks mature on every benchmark. Then, over that coffee, an employee admits the tools are lovely, but they don’t cover the system their coworker runs in another department or the AI project nobody in security owns.

That story stuck with me because the average enterprise runs between 50 and 60 security tools, and it’s easy to assume that many tools add up to full coverage.  

Attackers measure your security with a different yardstick: whether there’s a path from where they land to what they want. Security tool sprawl can hide that path from defenders.

To find it, CISOs need to see their environment the way an attacker does, map their stack against real attack paths, and build a Zero Trust architecture that assumes breaches are inevitable so the paths they miss lead nowhere.

Attack surface visibility starts from the outside in

Keren compared skilled attackers to savvy smugglers. They know which border post is short-staffed on a Friday afternoon and which fence has an “electric” sign with no current running through it. In the incident reports she’s studied, attackers often know a victim’s network better than the victim does.

Tools like Shodan and Censys have been around for years, yet Keren still meets organizations that have never used them to see what’s exposed from the outside. Shadow AI makes that blind spot bigger.  

When OpenClaw took off, plenty of well-meaning users changed its default from listening only on the local machine to listening on every network interface. Keren scanned for those installs recently and still found thousands sitting wide open.

Stack the deck: map your tools against the kill chain

Owning dozens of tools and having end-to-end coverage are two different things. Keren sees businesses confuse them all the time.  

The fix is a mapping exercise.  

Lay your tools against the Lockheed Martin Cyber Kill Chain or the MITRE ATT&CK framework and trace how a real attack would unfold, from reconnaissance through exfiltration. Wherever a stage has no detection or prevention behind it, the attacker still has a path.

Keren pointed out that most attackers start with the easiest route, usually a legitimate user’s credentials. That’s because it allows them to slip under the radar, and the security information and event management (SIEM) tool doesn’t blink.  

She also said that assuming a breach is already underway, then hunting for it and stopping it, is the sophisticated move. That’s the Zero Trust mindset.

Zero Trust turns attack paths into dead ends

No map stays complete for long, since every new vendor, API, cloud workload, and AI tool can open a gap.  

Zero Trust plans for that.  

Its core principle of least-privilege access gives every workload, user, and agent only the access it needs. Microsegmentation is how you enforce that principle across the network.

Keren put it best from the attacker’s perspective. If she gets into one system and can’t easily hop to the next, the attack stops there. In a segmented environment, an attacker might still find a forgotten system, but they’ll hit a dead end when they try to move on.

Why the attack path gap can’t wait

Keren said AI is a time machine for attackers. Reconnaissance and tool building that once took weeks now take hours or days, while patching hasn’t sped up to match.  

By her count, fewer than a third of the flaws in CISA’s Known Exploited Vulnerabilities catalog have been patched, and today’s motivated criminal groups will put in the extra effort when a target gets tricky.

Every unmapped gap now has a shorter shelf life, and security tool sprawl will keep growing with the business. This means that waiting for a perfect inventory only hands attackers more time.  

Map your tools against real attack paths, look at your environment the way an attacker would, and build a Zero Trust architecture that assumes breach. As Keren said, you don’t wait for the rain to build your tent.