Interactive Tool

Attack Tree Builder

Map attack paths with AND/OR logic, score path feasibility, connect mitigations to branches, and export report-ready threat-model evidence.

Node Types

Goal - Ultimate objective
Sub-Goal - Intermediate step
Attack - Specific technique
AND
AND Gate - All required
OR
OR Gate - Any path works
Mitigation - Defense control

How to Use

  1. 1. Load a template or start blank
  2. 2. Add nodes using the panel
  3. 3. Connect by dragging handles
  4. 4. Set attributes (difficulty, cost)
  5. 5. Export as JSON to share

Tip: Click nodes to edit. Drag to reposition. Use scroll to zoom.

Use Cases

Pentest Planning - Map attack paths before engagement
Threat Modeling - Identify threats in SDLC
Red Team Ops - Develop attack strategies
Defense Gaps - Find missing controls
Risk Analysis - Quantify attack feasibility

Attack Path Analysis

The tool calculates average difficulty across all attack steps. Use this to identify the "path of least resistance" - the attack chain with the lowest combined difficulty.

AND gates = All children required (high barrier)
OR gates = Any path works (attacker chooses easiest)

Further Reading

Schneier's Original Paper MITRE ATT&CK OWASP Threat Modeling Our Threat Modeling Guide