Attack tree (cybersec)

Native attack-tree diagrams for threat modelling and security review. Declare a root goal, then sub-goals as AND (all-of) or OR (any-of) refinements. Leaf nodes carry cost / skill / detection estimates that propagate up the tree. Critical paths render in red. Compatible with STRIDE / DREAD workflows.

Templates

Source language

plaintext

Workstation

Studio

Engine id

attacktree

Open in Studio

In the same space

Most users come to Attack tree (cybersec) from ADTool or Hand-drawn attack trees. Glyph runs this engine in the browser — no install, shareable via URL, exportable to PNG / SVG / PDF / source.

Syntax at a glance

goal G "Steal credentials"
OR G1 "Phishing" parent G
leaf L1 "Send email" parent G1 cost 1 skill low

Paste this in the Studio code pane to see Attack tree (cybersec) render live. The full grammar is at the upstream-docs link above.

Sample templates

All 8 →

operations

Attack tree — steal user credentials

Phishing + server compromise paths, with cost rollup.

operations

Attack tree — cloud account takeover

AWS / SaaS account takeover paths.

operations

Attack tree — data exfiltration

Insider, network, and side-channel exfil paths.

operations

Ransomware (Attack Tree)

Paths an attacker could take to deploy ransomware.

operations

Account Takeover (Attack Tree)

Attack paths to take over a bank account.

operations

Data-Centre Break-in (Attack Tree)

Paths to gain physical access to a facility.

Engine reference: attacktree · ← Browse all engines · Quick-start guide