Attack trees

Why this matters

An attack tree decomposes 'the attacker wins' into the OR/AND combinations of sub-goals that would achieve it. Where STRIDE is a checklist, attack trees are an actual logic structure — each leaf is a specific technique with a cost, and the root is reachable if any sufficient path is. They're how you reason about which control gives you the most marginal security per dollar.

Demo

Root goal: 'attacker reads my customers' PII'. OR branches: (1) compromise the DB host, (2) abuse an over-permissive query API, (3) phish an internal employee with prod access. Each branch decomposes further; each leaf has a cost.

Try it yourself

1. Draw an attack tree for a specific outcome you care about ('attacker drains the Stripe account', 'attacker reads emails').
2. Annotate each leaf with rough cost (free / hours / days / weeks).
3. Find the cheapest leaf that achieves the root. That's where your next security investment goes.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain attack trees and why they encode prioritisation.

2. Why it works (the mechanism)

Walk me through building an attack tree for a SaaS company's customer data.

3. Advanced — application & what's next

Critique attack trees as a method — what attacks do they miss, and what frameworks complement them?

References

• Bruce Schneier — Attack Trees
• OWASP — Attack Trees