Attack Tree
Template
A goal, an OR gate splitting into two approaches, an AND gate showing a multi-step path, and CAPEC-tagged leaf nodes -- the full anatomy of an attack tree, laid out and ready to relabel for your own threat.
Goal, gates, and leaf steps, already laid out
A worked example -- exfiltrating customer PII from a database -- decomposed two levels deep so both gate types appear at least once.
| Element | Shape | Example in the template |
|---|---|---|
| Goal | Red rounded rectangle | "Exfiltrate Customer PII from Database" -- the attacker's top-level objective |
| OR gate | Yellow diamond | Either branch alone achieves the goal -- app-layer compromise, or direct credential theft |
| AND gate | Yellow diamond | Both child steps are required together: find the SQLi point, then exploit it to dump data |
| Sub-goal / branch | Blue rounded rectangle | "Compromise Application Layer" and "Compromise DB Credentials Directly" |
| Leaf | Green rectangle | Three atomic steps, each tagged with a CAPEC ID |
Get the file
Opens directly in draw.io / diagrams.net, or drag it into the VS Code draw.io extension.
The tree tells you the path. It doesn't tell you the priority.
This template gets the logic right -- AND vs. OR, goal vs. leaf. What it can't do is score each path or connect it back to the system it targets.
-
Linked Back to Your DFD
In ThreatTree, every Attack Tree links to the exact Data Flow Diagram node it targets -- so a leaf step is grounded in a real architecture element, not a floating assumption.
-
Framework Tagging Beyond CAPEC
Tag leaf nodes with MITRE ATT&CK, OWASP Top 10, or (for AI systems) OWASP LLM/Agentic Top 10 and MITRE ATLAS -- all on the same node.
-
Likelihood x Impact Scoring
Score each leaf and let ThreatTree roll the highest-risk path up automatically into a ranked risk register -- instead of eyeballing which branch matters most.
-
Board-Ready PDF Reports
Export every tree in a forest, alongside the DFD and risk register, as a single PDF -- audit and board-ready without extra formatting work.
Questions about the template
What people ask before downloading.
Do I need to sign up to download this?
No. The download link goes straight to the file -- no email, no account, no form.
What's the difference between an AND gate and an OR gate?
An OR gate means any one child path achieves the parent goal on its own. An AND gate means every child step must succeed together before the parent goal is achieved -- an attacker needs all of them, not just one.
What should go in a leaf node?
One atomic, testable action -- specific enough that someone could attempt or defend against it directly, not a vague category like "hack the server."
How is this different from just using ThreatTree directly?
This template gets you a correctly structured tree. ThreatTree links each tree back to the exact Data Flow Diagram node it targets, scores every leaf by Likelihood x Impact, and rolls the result into a ranked risk register automatically.
Score it, link it, and export it in ThreatTree
Free plan available -- no credit card required. Build your first tree in minutes.