Map Every Path an Attacker Could Take (Attack Trees)

Why this matters

An attack tree decomposes 'the attacker wins' into the OR/AND combinations of sub-goals that would achieve it. Where STRIDE is a checklist, attack trees are an actual logic structure — each leaf is a specific technique with a cost, and the root is reachable if any sufficient path is. They're how you reason about which control gives you the most marginal security per dollar.

Demo

Root goal: 'attacker reads my customers' PII'. OR branches: (1) compromise the DB host, (2) abuse an over-permissive query API, (3) phish an internal employee with prod access. Each branch decomposes further; each leaf has a cost.

Try it yourself

1. Draw an attack tree for a specific outcome you care about ('attacker drains the Stripe account', 'attacker reads emails').
2. Annotate each leaf with rough cost (free / hours / days / weeks).
3. Find the cheapest leaf that achieves the root. That's where your next security investment goes.

References

• Bruce Schneier — Attack Trees
• OWASP — Attack Trees