Skip to content
ENExplore Calculators

Attack Tree Complexity Calculator

Measure attack-tree complexity: distinct paths to the goal, cheapest path cost, weakest-link exposure and defensive return.

About Attack Tree Complexity Calculator

An attack tree with OR branches multiplies out: three techniques at each of five steps is 243 distinct paths, and an attacker only needs one. AND gates are the defender's friend because they force several conditions to hold simultaneously, which is why the cheapest path — the one a real attacker takes — is bounded by the easiest technique at each step, not the average. Survival probability compounds control effectiveness across the covered steps. Attackers cost the cheapest path, not the average, so a defence that hardens four of five steps and leaves one trivial has changed almost nothing.

Formulas

Attack Tree Complexity

pathCount = branchingFactor ^ depth; complexity in bits = log₂(pathCount). Cheapest path = depth × cheapestStepCost plus the extra conditions AND gates impose.

branchingFactor
Alternative techniques available at each step
depth
Steps between initial access and the objective
andGates
Steps that need several conditions satisfied together

Getting through the controls

survivalProbability = (1 − controlEffectiveness) ^ controlledSteps — the chance an attempt crosses every controlled step undetected.

controlEffectiveness
Probability one control stops or catches the step
controlledSteps
Steps covered by a control

Worked example

With the default values below, Attack Tree Complexity Calculator returns Distinct Attack Paths of 243. Change any input above and every figure here is recalculated in your browser.

Inputs used

Steps from entry to the goalaccepts 1–40 steps
5 steps
Alternative techniques per stepaccepts 1–50 options
3 options
Steps requiring several conditions togetheraccepts 0–40 steps
2 steps
Average attacker effort per stepaccepts 0.1–2,000 hours
8 hours
Effort for the easiest technique at each stepaccepts 0.1–2,000 hours
2 hours
Steps with a detective or preventive controlaccepts 0–40 steps
3 steps
Average control effectivenessaccepts 0–100 %
65 %

Results

Distinct Attack Paths
243 paths
Cheapest Path Cost
14.0 hours
Average Path Cost
48.0 hours
Paths Touching a Control
60.0%
Probability an Attempt Reaches the Goal
4.3%
Complexity in Bits
7.92 bits
Highest-Value Defence
Strengthen existing controls: five weak checks still let most attempts through

Step by step

  1. 1Values used
  2. 2Attack Tree Complexity
  3. 3Getting through the controls
  4. 4Distinct Attack Paths= 243 paths
  5. 5Cheapest Path Cost= 14.0 hours
  6. 6Average Path Cost= 48.0 hours
  7. 7Paths Touching a Control= 60.0
  8. 8Probability an Attempt Reaches the Goal= 4.3
  9. 9Complexity in Bits= 7.92 bits

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Attack Tree Complexity calculated?

pathCount = branchingFactor ^ depth; complexity in bits = log₂(pathCount). Cheapest path = depth × cheapestStepCost plus the extra conditions AND gates impose. An attack tree with OR branches multiplies out: three techniques at each of five steps is 243 distinct paths, and an attacker only needs one. AND gates are the defender's friend because they force several conditions to hold simultaneously, which is why the cheapest path — the one a real attacker takes — is bounded by the easiest technique at each step, not the average. Survival probability compounds control effectiveness across the covered steps.

Why does Attack Tree Complexity matter?

Attackers cost the cheapest path, not the average, so a defence that hardens four of five steps and leaves one trivial has changed almost nothing.

What values do I need to enter?

This calculator takes 7 inputs: Steps from entry to the goal, Alternative techniques per step, Steps requiring several conditions together, Average attacker effort per step, Effort for the easiest technique at each step, Steps with a detective or preventive control, Average control effectiveness. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why express complexity in bits?

Because path counts explode: 3^5 is 243 but 4^8 is 65,536. Bits (log₂) keeps the numbers comparable and lets you say plainly that one design is eight bits harder to attack than another.

Does more branching mean the system is weaker?

Yes, from the defender's view. Each additional technique per step is another way through, which is why removing legacy protocols, unused interpreters and redundant admin paths is usually cheaper than defending them all.

Related Calculators

Attack Tree Complexity Calculator | Calcrivo