Attack Tree Complexity Calculator

Measure attack-tree complexity: distinct paths to the goal, cheapest path cost, weakest-link exposure and defensive return.

Inputs

Steps from entry to the goalsteps

Alternative techniques per stepoptions

Steps requiring several conditions togethersteps

Average attacker effort per stephours

Effort for the easiest technique at each stephours

Steps with a detective or preventive controlsteps

Average control effectiveness%

Distinct Attack Paths

243paths

Cheapest Path Cost

14.0hours

Average Path Cost

48.0hours

Paths Touching a Control

60.0%

Probability an Attempt Reaches the Goal

4.3%

Complexity in Bits

7.92bits

Highest-Value Defence

Strengthen existing controls: five weak checks still let most attempts through

Step by step

Values used
Steps from entry to the goal = 5 steps; Alternative techniques per step = 3 options; Steps requiring several conditions together = 2 steps; Average attacker effort per step = 8 hours; Effort for the easiest technique at each step = 2 hours; Steps with a detective or preventive control = 3 steps; Average control effectiveness = 65 %
Attack Tree Complexity
pathCount = branchingFactor ^ depth; complexity in bits = log₂(pathCount). Cheapest path = depth × cheapestStepCost plus the extra conditions AND gates impose.
Getting through the controls
survivalProbability = (1 − controlEffectiveness) ^ controlledSteps — the chance an attempt crosses every controlled step undetected.
Distinct Attack Paths
= 243 paths
Cheapest Path Cost
= 14.0 hours
Average Path Cost
= 48.0 hours
Paths Touching a Control
= 60.0
Probability an Attempt Reaches the Goal
= 4.3
Complexity in Bits
= 7.92 bits

How it works

An attack tree with OR branches multiplies out: three techniques at each of five steps is 243 distinct paths, and an attacker only needs one. AND gates are the defender's friend because they force several conditions to hold simultaneously, which is why the cheapest path — the one a real attacker takes — is bounded by the easiest technique at each step, not the average. Survival probability compounds control effectiveness across the covered steps. Attackers cost the cheapest path, not the average, so a defence that hardens four of five steps and leaves one trivial has changed almost nothing.

Formulas

Attack Tree Complexity

pathCount = branchingFactor ^ depth; complexity in bits = log₂(pathCount). Cheapest path = depth × cheapestStepCost plus the extra conditions AND gates impose.

branchingFactor: Alternative techniques available at each step
depth: Steps between initial access and the objective
andGates: Steps that need several conditions satisfied together

Getting through the controls

survivalProbability = (1 − controlEffectiveness) ^ controlledSteps — the chance an attempt crosses every controlled step undetected.

controlEffectiveness: Probability one control stops or catches the step
controlledSteps: Steps covered by a control

Frequently Asked Questions

How is Attack Tree Complexity calculated?

pathCount = branchingFactor ^ depth; complexity in bits = log₂(pathCount). Cheapest path = depth × cheapestStepCost plus the extra conditions AND gates impose. An attack tree with OR branches multiplies out: three techniques at each of five steps is 243 distinct paths, and an attacker only needs one. AND gates are the defender's friend because they force several conditions to hold simultaneously, which is why the cheapest path — the one a real attacker takes — is bounded by the easiest technique at each step, not the average. Survival probability compounds control effectiveness across the covered steps.

Why does Attack Tree Complexity matter?

Attackers cost the cheapest path, not the average, so a defence that hardens four of five steps and leaves one trivial has changed almost nothing.

What values do I need to enter?

This calculator takes 7 inputs: Steps from entry to the goal, Alternative techniques per step, Steps requiring several conditions together, Average attacker effort per step, Effort for the easiest technique at each step, Steps with a detective or preventive control, Average control effectiveness. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why express complexity in bits?

Because path counts explode: 3^5 is 243 but 4^8 is 65,536. Bits (log₂) keeps the numbers comparable and lets you say plainly that one design is eight bits harder to attack than another.

Does more branching mean the system is weaker?

Yes, from the defender's view. Each additional technique per step is another way through, which is why removing legacy protocols, unused interpreters and redundant admin paths is usually cheaper than defending them all.

You might also need

Threat Modeling Calculator Kill Chain Coverage Calculator Red Team Coverage Calculator