Methods of simulating
vulnerability are provided. In an example, multi-stage
vulnerability across multiple systems may be simulated by first simulating a probing of at least one intermediate entity, the at least one intermediate entity connected to a target
system, second simulating a probing of the target
system if the first simulated probing is successful and generating an
attack graph based on the results of the first and second simulating steps. In another example, multi-
system vulnerability may be simulated by receiving a plurality of attributes associated with vulnerabilities of a plurality of systems within a network, the plurality of systems including at least one target system and generating an
attack graph including one or more
attack chains based at least in part on the received plurality of attributes. In another example, system (e.g., single-system) vulnerability may be simulated by first simulating whether vulnerabilities exploited from a first system state cause a transition to a second system state, the second system state having a higher-
privilege level than the first system state within a target system and generating an
attack graph based at least in part on the results of the
simulation.