Key takeaway: Real attack paths cross code, identity, infrastructure, controls and organization-specific rules. Product security needs a full-system model.
A vulnerability does not live in "the cloud." It lives in a system assembled from code, identities, infrastructure, controls, deployment decisions and organizational rules.
A code scanner sees code. A cloud scanner sees cloud state. An identity product sees permissions. A WAF sees requests. An EDR sees endpoints.
The attacker sees the seams.
The attack path is the unit of truth
An authorization flaw that looks low-risk alone can depend on a broad service identity, a WAF exception, an internal route, legacy infrastructure, a trusted tenant identifier, an old exception or a business restriction that blocks the obvious fix.
None alone is the vulnerability. Together they can become the exploit path.
Security DNA is not another data lake
Organizational security DNA means the assumptions unique to the company: - architecture and trust boundaries; - secure-development rules; - threat models and approved exceptions; - data/environment restrictions; - separation of duties; - incident and pentest history; - compensating controls; - remediation decisions.
The goal is not ingesting everything. It is enough context to distinguish a generic weakness from a real organization-specific attack.
Security controls belong in the model
A WAF, network policy, identity control or endpoint rule can break a chain---or fail in ways inventory cannot reveal.
Do not ask only "is a WAF present?" Ask:
Did the control actually stop this path under the conditions tested?
Restrictions matter too
Autonomous research needs explicit targets, prohibited actions, production scope, data-access limits, destructive-action restrictions and human-approval boundaries.
The same context that makes testing smarter should make autonomy narrower.
Full-system context
SOURCE + APP/API + IDENTITY + INFRASTRUCTURE + SECURITY CONTROLS + ORG POLICY + RUNTIME + HISTORY
Then ask:
What attack path is actually possible here?
OWASP's agent-security guidance reinforces the architectural pattern: identity, tools, privileges, external data and runtime behavior must be considered together: https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html
About 0day Factory
0day Factory researches how real attack paths emerge across software, infrastructure, identity, security controls and organizational boundaries.