Attack Trees
Where STRIDE asks "what can go wrong across the whole system?", an attack tree zooms in on one objective an attacker wants — and maps every path to it. Popularised by Bruce Schneier, it's the sharpest tool for reasoning about how a single high-value asset could actually fall.
What it is
An attack tree is a hierarchical diagram of a single attacker goal. The root is the objective (e.g. "exfiltrate customer data"). Each layer below decomposes it into the sub-goals and concrete steps that could achieve it. Branches are combined with two kinds of logic: OR nodes are alternative routes (any one suffices), and AND nodes are steps that must all happen together. The leaves are individual attacker actions.
Because each node can carry attributes — cost, skill, detectability, probability — you can compute properties of whole paths and find the cheapest or most likely route, which is exactly the one to defend first.
How it works — a worked sketch
A small tree for one goal, with OR (alternatives) and AND (joint requirements):
- Via the AI assistant OR
- Prompt-inject to dump another user's context
- Coax the model into revealing its system prompt & keys
- Via a stolen credential AND
- Phish an employee password
- Bypass MFA
- Exploit an exposed backup / misconfigured store
Reading it: the goal falls if any top branch succeeds (OR). The stolen-credential branch needs both the password and the MFA bypass (AND). Annotate each leaf with effort and detectability, and the tree tells you which path is the soft underbelly.
How we audit your systems with attack trees
- We pick the goals that hurt — your crown-jewel outcomes, derived from STRIDE/PASTA, become the tree roots.
- We decompose to real steps — down to concrete attacker actions, not vague categories.
- We weight the paths — cost, skill and detectability per node, to rank routes by how attractive they are.
- We validate the cheap path — the most likely route is red-teamed against the live system to confirm it's real.
- For AI — model-specific leaves (prompt injection, tool abuse, data leakage) sit naturally alongside classic ones.
How we implement it
Attack trees are our zoom lens, not our wide angle: we reach for them when a specific outcome is too important to leave at checklist depth — a payment flow, a data-exfiltration scenario, an agent with powerful tools. They pair naturally with STRIDE (which surfaces the goals) and feed prioritisation by exposing the lowest-cost path. Findings and the defences they imply map to OWASP, the EU AI Act and NIST.
Attack trees were popularised by Bruce Schneier. This page reflects NexusFinLabs' practice and is general guidance, not legal advice.