Impacts¶

This page explains the Impact Type labels that the NodeZero Portal applies to pentest and assessment results, with details about the issues that trigger each impact.

AWS Account Compromise¶

Full compromise of an AWS account. All resources, services, and data in that account should be treated as compromised.

NodeZero reports this impact when:

It obtains an AWS admin user, admin role, or root user credential.
It simulates privilege escalation that yields administrator permissions in the account.

AWS User/Role Compromise¶

An AWS IAM user or role that NodeZero obtained, other than the NodeZero pentest roles you create for the assessment. Anything that user or role can access — including cloud resources, services, and data — should be treated as compromised.

NodeZero reports this impact when it obtains an AWS user, role, admin user, admin role, or root user credential. Cognito roles are omitted unless they are also tied to a credential weakness. The pentest roles NodeZeroPentestRole, NodeZeroPentest-SecurityAudit-Role, and NodeZeroPentest-ReadOnlyAccess-Role are ignored.

Brand Compromise¶

Ways an attacker can harm the company’s reputation, such as taking over a public hostname or injecting content into a company web application.

NodeZero reports this impact when:

A subdomain takeover weakness affects an external domain.
A cross-site scripting (XSS) weakness affects a web application.

Business Email Compromise¶

Access that lets an attacker send and receive mail as a legitimate user. That access is commonly used for invoice fraud, targeted phishing, and theft of sensitive information.

NodeZero reports this impact when a credential can access a Microsoft Outlook / Microsoft 365 mailbox.

Cloud Principal Compromise¶

A cloud service principal that NodeZero obtained. Service principals typically do not require multi-factor authentication, so they are a high-value target. Any application, service, or resource the principal can access should be treated as compromised.

NodeZero reports this impact when:

It obtains an Entra service principal or admin service principal credential.
A service principal can escalate privilege through over-permissive IAM (Identity and Access Management) policies.

Cloud Resource Compromise¶

A cloud resource such as a storage account, container registry, or other managed service is exposed in a way that can allow unauthorized access, data exposure, or further exploitation of the cloud environment.

NodeZero reports this impact when a cloud-resource weakness is proven that enables code execution, including Azure Container Registry (ACR) task code execution, Azure Kubernetes Service (AKS) code execution, and App Service code execution.

Critical Infrastructure Compromise¶

Compromise of key devices and applications that give an attacker a privileged position on the network, from which they can reach sensitive data and launch further attacks.

NodeZero reports this impact when:

A weakness is proven against an application or service marked as critical infrastructure.
A credential can access an application marked as critical infrastructure.
Host compromise includes admin-level remote code execution (RCE) on a host that runs critical infrastructure applications.

Domain Compromise¶

Full compromise of an Active Directory domain. Hosts, domain accounts, data, infrastructure, and applications tied to that domain should be treated as compromised, as should applications on domain-joined machines or that use AD for authentication.

NodeZero reports this impact when:

It obtains a Domain Admin credential.
RCE is proven on a domain controller.
The Certifried weakness (CVE-2022-26923) is present.

Domain User Compromise¶

A domain user account that NodeZero obtained. Anything that account can access should be treated as compromised.

NodeZero reports this impact when:

It obtains a domain user (or Domain Admin) credential.
It finds an expired potential credential for a domain identity.

Host Compromise¶

Control of an internal host. That access can expose sensitive information, can persist in the network, and can enable lateral movement.

The same host-level outcomes are labeled Perimeter Breach when NodeZero achieves them from outside the network (in External or WebApp pentests). Where hosts are reached only after NodeZero pivots inward, they are reported as Host Compromise.

NodeZero reports this impact when:

A domain user has local administrator access to the host’s SMB (Server Message Block) service.
RCE is proven on the host (including OS command injection on a web parameter).
A credential has RCE access to a service or login form on the host.
A relay attack against the host succeeds (for example, dumping local credentials).
Privilege escalation succeeds on the host.
A credential executes code on a cloud-resource endpoint, or a Kubernetes pod endpoint, associated with the host.

Kubernetes Cluster Compromise¶

Full compromise of a Kubernetes cluster. All pods, services, secrets, service accounts, and data should be treated as compromised.

NodeZero reports this impact when it obtains a Kubernetes identity credential that is an admin identity.

Kubernetes Identity Compromise¶

A Kubernetes identity that NodeZero obtained. Anything that identity can access should be treated as compromised. This includes pods, services, secrets, service accounts, and data.

NodeZero reports this impact when it obtains a credential bound to a Kubernetes identity.

Microsoft Entra Full Tenant Compromise¶

Full compromise of a Microsoft Entra tenant. Any application, service, or resource that uses the tenant for identity and access management should be treated as compromised. This includes Microsoft 365 and Azure-hosted resources.

NodeZero reports this impact when:

It obtains an Entra Global Admin credential.
It obtains an admin service principal.
Privilege escalation reaches Global Admin, including service principal over-privilege and Entra role-admin escalation.

Microsoft Entra User Compromise¶

A Microsoft Entra (Azure AD) user credential that NodeZero obtained. Anything that user can access should be treated as compromised. This includes the Entra tenant, Microsoft 365, and Azure subscriptions.

NodeZero reports this impact when it obtains a domain user credential that belongs to an Azure/Entra domain.

Perimeter Breach¶

The same class of host-level compromise as Host Compromise, but reported when NodeZero achieves this compromise from outside the customer’s perimeter (via an External or WebApp pentest). Hosts reached only through an inward pivot are reported as Host Compromise.

Ransomware Exposure¶

Attackers could encrypt business-critical data stores, and demand payment for the decryption key. Even after payment, restoring data and services can severely disrupt operations.

NodeZero reports this impact when:

A credential has write access to a file share, database, or similar store that holds a large number of resources (typically more than 100), excluding Docker registries.
A credential has write access to an S3 bucket with a similarly large number of resources.
A weakness is proven that enables both RCE and ransomware behavior.

Sensitive Data Exposure¶

Attackers could obtain credentials, PII (personally identifiable information), financial data, or other business-critical information.

NodeZero reports this impact when:

A credential can read a file share or repository that contains sensitive files or high-confidence, business-risk data.
A credential can access a database or Docker registry.
Host compromise includes admin-level RCE on a host that contains a database or Docker registry.
A Git repository contains sensitive findings.

Supply Chain Compromise¶

An attacker can access or tamper with software artifacts, such as container images in a registry, and can inject malicious code into downstream build and deployment pipelines.

NodeZero reports this impact when ACR weaknesses are proven – for example: anonymous pull, an admin user on the registry, or task code execution.

Third-Party SaaS User Compromise¶

A third-party SaaS user that NodeZero obtained. Anything that user can access — including private messages, files, and other application-specific items — should be treated as compromised.

NodeZero reports this impact when credentials dumped from memory (or otherwise proven) can access a third-party SaaS application.

Web Application User Compromise¶

A web application user account that NodeZero obtained. Anything that account can access in the application should be treated as compromised. This includes sensitive data, application functionality, and integrated services that trust the user’s session.

NodeZero reports this impact when SQL injection on a web parameter yields credential access to the application (i.e., login fuzzing with proof).

Web Session Compromise¶

Hijacking of an authenticated web session (for example through stored XSS). An attacker can act as the victim user, see data that user can see, steal session tokens or credentials, and potentially reach other systems that trust the application.

NodeZero reports this impact when a stored XSS weakness is proven on a web parameter.