Lateral-movement paths through identities and permissions are invisible until an attacker walks them, so the routes from a low-value account to a crown jewel go unmapped. Defence is blind to the graph.
"If an attacker landed on any account, what's the shortest path from there to our crown jewels?"
Exploitable attack paths
Live path analysis
To first outcomes