potential attack paths