a3thinker
Illustrated portrait of Luigi Iacuaniello

Luigi Iacuaniello

Cybersecurity Software Engineer · Naples, Italy 🇮🇹

ScrollSwipe

01 Projects

2026 · Open source - my own work

PerspectiveGraph

An open-source attack-path engine

An open-source engine that asks one question of every pull request: does this change open a path from the internet, through too much privilege, to something worth stealing? Each hop gets a probability instead of a severity label, and where the engine isn't sure, it says so rather than rounding up. I also built a red-team oracle that checks its conclusions against the live AWS policy-evaluation API - and it caught my own engine ignoring an IAM permissions boundary, and reporting an escalation the boundary made impossible. That false positive is a regression test now.

Live demo ↗Documentation ↗Source on GitHub ↗

The Attack paths view of the public demo: routes ranked by priority on the left, and on the right the selected route from an internet-facing load balancer to an AdministratorAccess role - its exploit probability, then a kill chain listing each hop with its probability, the evidence that probability came from, and the mapped ATT&CK technique.
Routes ranked by what to fix first - and every hop with its probability, where that probability came from, and the mapped ATT&CK technique.

Highlights

  • Apache 2.0, public repository, CI running on every commit
  • Container images signed with cosign, with SBOM and SLSA build provenance
  • Graded in CI against four CloudGoat-shaped scenarios, including two that must produce no finding
  • Privilege hops validated against the live AWS policy-evaluation API

Built with

GoPostgreSQL + Apache AGETypeScriptKubernetesAWS IAMNATSGraphQL

02 Articles

What went wrong while building PerspectiveGraph, how I found out, and what I changed. Each one also says what it does not prove.

6 articles · newest first

  1. 12 October 2026 · 8 min read

    Two scanners agreed, and the code was not in my binary

    A scan of the web server my project builds reported a High-severity vulnerability in its HTTP/2 library. A second scanner, one that checks which functions a program actually calls, confirmed the vulnerability and found four more. I drafted the release note warning operators that anyone on the internet could take down their dashboard. I then checked the binary and discovered that the vulnerable server was not present.

  2. 12 October 2026 · 7 min read

    AWS now traces the IAM part of my attack paths

    In July, AWS Security Hub started tracing privilege escalation chains from exposed resources. Within an AWS account, this is the question my engine was designed to answer, and AWS partially addresses this question with policy logic that my engine does not read. Here is what AWS does better, what its documentation does not describe, and where I have moved my work.

  3. 12 October 2026 · 6 min read

    One shipped, one shelved: two changes to how my engine counts evidence

    Two changes to how my engine weighs evidence, proposed on the same day. Both sounded reasonable. One fixed a real bug - a vulnerability counted as two opportunities for an attacker - and was implemented within a few hours. I evaluated the other before writing it, and the data advised against implementing it.

  4. 12 October 2026 · 10 min read

    Same name, different thing: five identity bugs in my attack-path engine

    An attack-path engine combines data from multiple tools into a single graph, with each tool assigning different names to the elements. If it cannot recognize that two names have the same meaning, the actual paths break down. If it interprets two different elements as a single one, it generates nonexistent paths. I found five places where my engine made this mistake - and in three of them, it created nonexistent paths.

  5. 12 October 2026 · 7 min read

    The pull request that passed clean because of a file name

    My engine's merge check has three responses: clean, blocked, and unknown. The third exists so that a pull request nobody analyzed cannot get the same green checkmark as a safe one. A pull request whose image was on a path from the internet to a sensitive asset still got the green checkmark. The scan had arrived on time and intact. It wasn't attached to anything, due to a file name.

  6. 12 October 2026 · 10 min read

    The false positive AWS found in my own engine

    My open source engine, PerspectiveGraph, reported that a role in my AWS account could make itself administrator. It could not: a permissions boundary stopped it, and the engine had never read the boundary. I did not find this by reading my code. AWS told me.

03 Contact

I reply within 2-3 business days.