Abstract: A method includes generating, by a processing device, at least one security zone comprising a set of objects of a computing environment using at least one identity system, and identifying, by the processing device, a set of attack paths leading to the at least one security zone. Each attack path of the set of attack paths includes a respective target object accessible via a respective source object through at least one control relationship, and each target object is included within the set of objects of the at least one security zone. The method further includes performing, by the processing device based on the set of attack paths, attack path monitoring and risk mitigation.