An attack tree takes a single high-level attacker goal — "steal customer payment data," "take over an admin account" — and breaks it down, level by level, into the concrete, atomic steps an attacker would actually need to perform to achieve it. Where a Data Flow Diagram maps a whole system broadly, an attack tree goes deep on one specific threat.
Quick definition: An attack tree is a hierarchical diagram with a goal at the root, intermediate nodes connected by AND/OR logic, and leaf nodes representing concrete, individually achievable attack steps.
Structure: root, gates, and leaves
- Root node — the attacker's ultimate goal, stated as a specific outcome, not a vague category. "Exfiltrate customer data from the RDS database" is a good root; "hack the system" is not.
- OR gate — any one child achieves the parent. If the goal is "gain admin access," and the children are "phish an admin's credentials" OR "exploit a privilege-escalation bug," succeeding at either one is enough.
- AND gate — every child must succeed for the parent to succeed. "Exploit the privilege-escalation bug" might require both "find the vulnerable endpoint" AND "obtain a valid low-privilege session first."
- Leaf node — a concrete, atomic attack step that isn't broken down further: "brute-force the login form," "find the endpoint via directory enumeration."
A worked example
Take the goal "Exfiltrate Customer Data from the Database." Broken down with an OR gate, an attacker has (at least) three independent paths: compromise the database credentials directly, exploit a SQL injection vulnerability in an API endpoint, or compromise an admin account and use its legitimate database access. Each of those three branches can be decomposed further — "compromise the database credentials" might itself be an OR of "find credentials in a leaked config file" or "phish an engineer with database access."
The value isn't just the diagram — it's that every leaf node is now a concrete, scoreable thing. You can rate each leaf's likelihood and impact, roll that up through the AND/OR gates to see which path is actually the attacker's easiest route to the goal, and prioritise mitigating that path first instead of guessing.
Want to try this yourself? Grab our free Attack Tree template — goal, AND/OR gates, and CAPEC-tagged leaves already laid out in draw.io, no signup required.
Attack trees vs. Data Flow Diagrams
These two artifacts answer different questions and work best together. A DFD answers "what are all the ways something could go wrong across this whole system?" — broad coverage, shallow per threat. An attack tree answers "given this one specific goal, exactly how would an attacker get there, and which path is most likely?" — narrow scope, deep decomposition.
In practice: run STRIDE across a DFD to surface a broad list of threats, then pick the highest-severity ones and build an attack tree for each to understand the actual attack paths well enough to prioritise mitigations and, if needed, hand a concrete scope to a penetration tester.