Attack trees explained with a small worked example

An attack tree puts one attacker goal at the top and breaks it into the ways to reach it, branch by branch, until each leaf is a concrete action. It suits questions about how an attacker would reach a specific bad outcome. OWASP's threat modeling process mentions threat trees as a way to organise threats.

The structure

• The root is the goal, such as "take over a customer account".
• Branches are the alternative ways to get there.
• AND nodes need all their children to succeed. OR nodes need only one.
• Leaves are individual actions you can test, rate and defend.

Trees fit threat modeling because they force you to think from the attacker's side. STRIDE asks what could go wrong at each element. A tree asks how a chosen outcome could be reached across elements.

Build one in four steps

1. Pick one goal. Keep it specific and tied to a business loss.
2. List the ways, two levels deep. Brainstorm freely, then group.
3. Mark AND and OR. Many errors come from forgetting that a path needs two things at once.
4. Annotate the leaves. Add likelihood, impact and the existing control, if any. OWASP's process suggests simple High, Medium and Low ratings.

Example: take over a customer account

Goal: attacker controls a customer account.

OR branch 1: steal the password.

• Phish the user.
• Reuse a password from another breach.
• Guess a weak password on the login page.

OR branch 2: bypass the password.

• Abuse the password reset flow, which works if the attacker controls the user's email or the reset token is guessable.
• Hijack an active session, for example by stealing a session cookie through a script injection flaw.

OR branch 3: go through support.

• Persuade a support agent to change the email address.

Now annotate. Guessing a weak password with no rate limit is easy and has high impact, so it is High. Persuading support depends on your verification script, so rate it based on what the agent must check.

What the tree tells you

• Which leaves are cheapest for the attacker. These are your first fixes.
• Which controls cover several leaves. Multi factor authentication helps with branch 1 but not with support abuse.
• Where one control is the only barrier. These are single points of failure.
• Which branches you had not considered, such as the support route.

Where trees help most

• A single high value asset, like admin access or customer data export.
• Explaining risk to non technical readers. A tree is easy to follow.
• Planning a penetration test around specific goals.

Where trees struggle

• Large systems. The tree grows fast. Split by goal and keep each small.
• Unknown techniques. The tree only shows what you imagine. Pair it with STRIDE prompts and varied viewpoints.
• Maintenance. Like other models, a tree goes stale. Update it when the design changes.

How it fits with the rest

Use a data flow diagram to show the system, STRIDE to list threats per element, and trees for the few outcomes that matter most. OWASP notes other techniques such as LINDDUN, PASTA, OCTAVE and VAST suit different scopes, so match the method to the question.

Quick check

Sources

• OWASP Threat Modeling Process
• OWASP Threat Modeling Cheat Sheet

Last reviewed: 19 October 2026.