See the path. Prove the gap.
Most pentest tools list vulnerabilities. RedPath answers the question a SOC team actually needs answered: if this attack path exists, do we have evidence that we would detect it?
RedPath turns a synthetic Active Directory trust map into a visual case file: weighted exposure paths, ATT&CK-aligned detection coverage, evidence-backed findings, and practical remediation in one explainable console. It is safe to explore immediately—no directory, credentials, agent, API key, or clone required.
- Explore a complete attack-path case file in your browser: open the seeded live demo.
- Connect exposure to detection: inspect weighted paths, chokepoints, ATT&CK coverage, evidence, and remediation together.
- Built for safe evaluation: every asset, path, finding, and scenario is fully synthetic and dry-run by design.
Product walkthrough: A concise tour of the attack-path graph, detection-coverage view, and report workflow is planned for this section. Maintainers can follow the free recording guide in
docs/record-demo.mdto addassets/demo/redpath-walkthrough.gif(under 10 MB) from the live demo.
| In less than one minute | What the viewer sees |
|---|---|
| Attack path graph | A weighted, visual chain from a user-side asset to a privileged objective, with observed versus inferred relationships. |
| Detection coverage | ATT&CK-aligned coverage by tactic, purple-team gaps, and the evidence supporting each verdict. |
| Case report workflow | Evidence cards, remediation ownership, and a print-ready case-file layout that can be saved as a PDF from the browser. |
| Generic vulnerability scanner | RedPath |
|---|---|
| Lists isolated weaknesses. | Connects weak signals into an explainable, weighted exposure path. |
| Reports a finding without showing defensive context. | Maps each path and finding to detection coverage and a clear gap verdict. |
| Usually requires an environment connection before it is useful. | Starts instantly with a safe, synthetic domain that is already explorable. |
| Treats remediation as a generic recommendation. | Keeps evidence, ATT&CK context, remediation owner, and review state in the same case file. |
| Surface | What it demonstrates |
|---|---|
| Attack-path explorer | Weighted synthetic Active Directory relationships, shortest paths, chokepoints, and observed versus inferred edges. |
| Detection coverage | Expected behaviors mapped to ATT&CK techniques, purple-team evidence, coverage by tactic, and gap verdicts. |
| Findings dossier | Asset-level severity, CVSS, technique mapping, supporting evidence, and a concrete remediation action. |
| Safe scenario library | Four individually detailed playbooks with expected techniques, dry-run recon plans, and evidence-backed risk summaries. |
| Case-file report | A structured, print-ready briefing surface that can be saved as a PDF from a browser without an external reporting service. |
The live demo is the fastest route. To run the same seeded console locally, use three commands:
git clone https://github.com/Adam-Ghanem/RedPath.git && cd RedPath/frontend
pnpm install
pnpm devOpen http://localhost:5173. The frontend renders the synthetic lab immediately and does not connect to a directory or execute commands.
The default dataset models six fictional assets, five evidence-backed findings, three weighted paths, ATT&CK tactic coverage, and four safe scenario playbooks. It is intentionally a synthetic, dry-run learning and evaluation environment.
| Synthetic scenario | Expected techniques | Coverage verdict |
|---|---|---|
| Service identity exposure | T1558.003, T1021.002 |
Coverage gap |
| Pre-authentication drift | T1558.004, T1098 |
Partially covered |
| Certificate template escape | T1649, T1098 |
Coverage gap |
| File services blast radius | T1021.002, T1098 |
Validated |
RedPath must only be used against systems you own or are explicitly authorized to assess. Demo mode contains fabricated hosts, identities, evidence, and paths; it does not store credentials, execute reconnaissance, or connect to an Active Directory environment.
The browser-first console uses pre-seeded TypeScript data to stay immediately explorable. The repository also includes a FastAPI backend for authorized lab workflows, audit-oriented services, and Docker Compose guidance; the live demo remains useful without those services.
| Forensic dashboard | Interactive path console |
|---|---|
|
 |
See the screenshot guide for verified views and data-handling notes.
The optional stack is for maintainers inspecting API contracts—not for using the demo.
docker compose --profile demo up --buildThe console is available at http://localhost:5173; API documentation is available at http://localhost:8000/docs. Read the safe demo deployment guide before deploying the profile to Render or Fly.io.
Contributions are welcome when they preserve RedPath’s safe, explainable, and reproducible design. Read CONTRIBUTING.md before opening an issue or pull request.
- Add a concise, real browser walkthrough GIF for the live dashboard, coverage view, and PDF save flow.
- Add evidence-detail deep links from each graph node.
- Publish additional synthetic scenarios for identity, certificate, and lateral-movement coverage gaps.