What-If Analysis

What Is What-If Analysis?

What-if analysis, in FireMon Risk Analyzer, is a simulation capability that models the security impact of a proposed firewall rule change or a delayed patch before anyone acts on it. It runs attack and change simulations against live network policy, helping teams see the consequences of a decision before it's made rather than after.

Key takeaways

• What-if analysis is a Risk Analyzer capability that simulates attacks and policy changes to show their security impact before implementation.
• It helps teams evaluate the consequences of adding a new rule or delaying a patch, supporting data-driven decisions for both remediation and change management.
• Risk Analyzer runs as an add-on to FireMon Security Manager, which supplies the policy visibility and network topology the simulations depend on.
• Results surface through a visual dashboard with attack path graphs and risk scores, making it easier to understand and communicate the impact of a decision.

Why It Matters

Firewall teams face two kinds of decisions that are hard to evaluate in the moment: whether to approve a new access request, and whether to accept the risk of a known vulnerability sitting unpatched for another cycle. Both decisions carry consequences that aren't visible from the rule or the vulnerability alone. A new rule might look harmless on its own, but it could open a path to a system that's already vulnerable. A delayed patch might seem low priority, but if the affected system sits on a route an attacker could reach, the delay matters a lot more than a CVSS score suggests.

What-if analysis exists to answer that question before the decision is final. Instead of approving a change and finding out what it did afterward, teams can model the outcome first. Policy is the control plane for network security, and what-if analysis is one of the places where that control gets tested before a change becomes part of production policy.

How It Works

What-if analysis is a capability within FireMon Risk Analyzer, an add-on module to FireMon Security Manager. Risk Analyzer correlates vulnerability data from scanners like Qualys, Rapid7, and Tenable with live network policy, then uses that correlation to run attack and change simulations. Visual attack graphs trace every reachable route across the network topology, revealing paths that policy complexity would otherwise hide.

When a team runs a what-if scenario, Risk Analyzer models how an attacker could move through the network under a proposed condition, whether that's a new rule being added or a known vulnerability staying unpatched for a set period. The output includes attack path graphs, risk scores based on penetration depth and business impact, and remediation recommendations prioritized by effectiveness, so the result is something a team can act on and explain to stakeholders, not just a raw simulation log.

A Realistic Example

A security team gets a request to open access from a partner network to an internal application server. Before approving it, they run a what-if attack assessment in Risk Analyzer. The simulation shows that the application server sits on a path that also reaches a database with a known, unpatched vulnerability. Approving the rule as written would create a new route an attacker could use to reach that database. The team can see this before the rule goes live, which means they can scope the access more narrowly or require the patch first, instead of discovering the exposure during an audit or after an incident.

The Operational Consequence

Without what-if analysis, teams are left evaluating new rules and patch delays based on incomplete information: a port and an IP address, or a CVSS score detached from the network's actual layout. Decisions made this way tend to be right by accident as often as they're right by design. With what-if analysis, the same decisions get made against a model of what's actually reachable, which turns a guess into a documented, defensible call. That shift matters for both risk reduction and operational efficiency, since catching a problem before a change is live costs far less than catching it after the fact.

Key Components and Best Practices

What-if analysis in Risk Analyzer depends on a few things working together: live, normalized policy data from Security Manager; vulnerability data pulled in from integrated scanners; and network topology that lets the simulation trace realistic attack paths rather than guessing at them. Teams get the most value when they run what-if scenarios consistently, for both new access requests and patch-delay decisions, rather than reserving them for high-profile changes. Reviewing the attack path graphs and risk scores as a team, rather than relying on a single reviewer's read of the output, also helps catch disagreements about acceptable risk before a change is approved.

Common Challenges

The main challenge is treating what-if analysis as optional rather than routine. A simulation that only gets run on major changes misses the accumulation of smaller rule additions that, together, open a path nobody intended. Another challenge is relying on the simulation output without the context behind it. A risk score or an attack graph is only as useful as the team's willingness to act on what it shows, including narrowing a rule or pushing back on a patch delay that the simulation flags as risky.

How It Connects to Network Security Policy Management and FireMon

What-if analysis is one function within the broader discipline of network security policy management (NSPM), which governs how firewall rules and access paths are created, reviewed, and changed over time. FireMon, the founder of NSPM, builds what-if analysis into Risk Analyzer, which runs as an add-on to Security Manager and draws on its policy visibility and network topology data to power attack and change simulations. Risk Analyzer is also used alongside Policy Planner, where it adds a pre-flight risk check to proposed changes before they move through approval and implementation.