Guide · 6 min read
Attack trees explained: mapping how an attacker reaches a goal
How to build an attack tree: root goal, AND/OR branches, attributes like cost and likelihood, and how to use the cheapest paths to choose controls and test them.
Attack trees were popularised by Bruce Schneier in 1999. They are one of the simplest ways to think like an attacker: write down what the attacker wants, then every way they could get it.
How to build one
- Write the goal at the root. For example, “read patient records from the booking system”.
- Branch into ways to achieve it. Steal a staff login, exploit an injection flaw, access a backup, bribe an insider.
- Mark OR and AND nodes. OR means any child is enough; AND means all children are needed (for example, steal a password and bypass MFA).
- Keep breaking branches down until the leaves are concrete actions you could test.
- Add attributes to the leaves, such as cost, skill needed, likelihood or whether it is detectable.
Using the tree
Once the leaves have attributes, you can find the cheapest or most likely path to the root. That is where controls give the most value. Adding a control to an AND branch can cut off a whole path; adding one to a single OR branch often just pushes the attacker to the next branch.
Example: reading patient records
- OR: use a staff support portal login
- AND: phish a support agent’s password, and the portal has no MFA.
- OR: exploit SQL injection in the booking search.
- OR: download an unencrypted database backup from misconfigured cloud storage.
Here the support portal path is cheap and needs no technical skill, so MFA on the portal and named accounts are the first controls to fund.
Where attack trees fit
- They pair well with STRIDE: STRIDE finds the threats, an attack tree shows how a high-rated threat would actually be carried out.
- They are stage 6 (attack modeling) in PASTA.
- They make great input for penetration test scoping and red team objectives.
What an auditor looks for
For key systems, evidence that the most likely attack paths were identified and that controls were placed on them, plus tests (penetration tests, control tests) that confirm those controls actually block the path.