Network security analysis must coordinate diverse sources of information to support effective security models. The modeling process must capture security-relevant information about targets and attackers. By capturing the trust relationships, vulnerabilities, and attacker capabilities, a security analyst can define and characterize complex, multi-stage attacks. Along with conducting systematic analyses on multi-stage attacks, the opportunity also exists to facilitate large scale detection and visualization of security events by embedding modeling and analytical components within a more expansive security framework. This paper presents a formalism and methodology for multi-stage network attack analysis. Applications to network security management, including a network vulnerability analyzer prototype, are also described.