An attack path is rarely a single step. It consists of several sub-steps that build on each other: gaining network access, bypassing authentication, installing firmware, establishing persistence. Each sub-step can be assessed individually — and then you face a question that is surprisingly often skipped: How do you turn that into a value for the entire path?
The answer is not a formality. It determines which measure gets implemented first.
First: OR or AND?
Before aggregating, the structure must be clear. An attack tree has two kinds of branches, and they behave in opposite ways:
OR nodes: Several routes lead to the goal, and one is enough. The attacker chooses — and chooses the easiest. The difficulty of the overall path is therefore that of the easiest sub-path.
AND nodes: Several conditions must be met together. The attacker needs all of them. The difficulty adds up — and breaking one condition is enough to close the path.
This distinction is already half the answer. If you model it cleanly, you get the right aggregation rule for each node along with it.
Three ways to combine sub-steps
For the sub-steps within a path, three approaches have become established:
| Approach | Logic | Strength | Weakness |
|---|---|---|---|
| Weakest link | The easiest sub-step determines the value | realistic when there is a choice; conservative | ignores that many easy steps add up to real effort |
| Sum | All sub-steps are added | reflects chains where everything really is required | overestimates paths where the attacker can take a shortcut |
| Average | Mean across the sub-steps | smooths out outliers | dilutes — a trivial entry point disappears behind difficult follow-up steps |
In practice, a weighted hybrid works well: OR branches by weakest link, AND combinations additively, and weights for individual factors that suit the product. For a field device in a locked control cabinet, the window of opportunity weighs more heavily than the required equipment; for a device on an open network, it is the other way round.
Why the average is almost always the wrong choice
Of the three approaches, the mean is the most tempting and the most dangerous. It looks balanced and produces nice numbers — and it hides exactly what matters.
An example: a path consists of a trivial entry point (an open debug port) and three demanding follow-up steps. The average looks moderate. In reality, the open port is the problem — it is the point where a single measure cuts off the entire path.
Rating serves prioritization. A method that makes the cheapest effective measure invisible misses its purpose.
The rule that follows
The structure directly yields the instruction: Break the easiest complete path first. Not the most spectacular one, not the most technically interesting one, not the one that was the subject of the latest conference talk.
The reason is simple: an attacker looks for the cheapest route. As long as it is open, hardening the more difficult routes does nothing to their chances of success — it only consumes budget.
With AND combinations, the rule is particularly effective. Because all conditions must be met there, it is enough to address the condition that is cheapest to eliminate. A path that requires network access and missing integrity protection can be closed via integrity protection — even if network access remains possible.
What needs to be documented
Which approach you choose matters less than making the choice traceable. Three things therefore belong in the analysis:
The aggregation rule itself. One sentence is enough: "OR nodes by weakest link, AND nodes additively." Without this statement, not a single number in the analysis can be recalculated.
The weighting and its rationale. If the window of opportunity carries more weight, it should say why — typically a property of the operating environment.
Consistency across paths. Different rules for different paths make the results incomparable, and comparability is the only reason to aggregate at all.
An honest look at precision
None of these methods produces a measured quantity. They produce a robust ranking — and that is exactly the point. Anyone who rates attack paths to two decimal places is confusing traceability with precision.
The question a rating has to answer is not "how high exactly is this risk?", but "where do we start, and can we justify it?"
Sources
This article was originally published in German on the Alsensio Cybersecurity Hub.
