Attack Tree

Overview

An attack tree begins with an unwanted outcome at its root, such as stealing treasury funds or taking over an account. Branches describe the different conditions, techniques, or subgoals that could lead to that result.

Nodes may represent alternatives where any one method succeeds or combinations where several conditions are required. Teams can annotate branches with likelihood, cost, skill, prerequisites, detectability, impact, and existing controls to compare realistic routes.

Attack trees support threat modeling, security reviews, incident exercises, and control prioritization. They are only as useful as their assumptions, so models should include people, third parties, operational workflows, and changing architecture rather than focusing solely on software exploits.

An attack tree is a hierarchical model that breaks an adversary’s objective into alternative or combined steps required for success. An attack tree converts a broad threat into structured paths, making assumptions, control gaps, and high-leverage defenses easier to evaluate.

Assessment of Attack Tree should trace a hierarchical model that breaks an adversary’s objective into alternative or combined steps required for success from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving combined steps required for success should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Attack Tree context should be tested against the architecture associated with combined steps required for success.

Retesting for Attack Tree should reproduce the Attack Tree context involving combined steps required for success, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.