What is Attack Tree?

An attack tree is a diagram that models the different ways an attacker could achieve a particular goal. The attacker's objective sits at the root, and the branches enumerate the sub-goals and methods that could lead to it — creating a structured, hierarchical view of attack paths.

Attack trees complement category-based methods like STRIDE by focusing on how a specific goal could be reached, which helps teams reason about realistic attack paths and where to place defenses.