Measure attack-tree complexity: distinct paths to the goal, cheapest path cost, weakest-link exposure and defensive return.
An attack tree with OR branches multiplies out: three techniques at each of five steps is 243 distinct paths, and an attacker only needs one. AND gates are the defender's friend because they force several conditions to hold simultaneously, which is why the cheapest path — the one a real attacker takes — is bounded by the easiest technique at each step, not the average. Survival probability compounds control effectiveness across the covered steps. Attackers cost the cheapest path, not the average, so a defence that hardens four of five steps and leaves one trivial has changed almost nothing.
Attack Tree Complexity
pathCount = branchingFactor ^ depth; complexity in bits = log₂(pathCount). Cheapest path = depth × cheapestStepCost plus the extra conditions AND gates impose.
Getting through the controls
survivalProbability = (1 − controlEffectiveness) ^ controlledSteps — the chance an attempt crosses every controlled step undetected.
pathCount = branchingFactor ^ depth; complexity in bits = log₂(pathCount). Cheapest path = depth × cheapestStepCost plus the extra conditions AND gates impose. An attack tree with OR branches multiplies out: three techniques at each of five steps is 243 distinct paths, and an attacker only needs one. AND gates are the defender's friend because they force several conditions to hold simultaneously, which is why the cheapest path — the one a real attacker takes — is bounded by the easiest technique at each step, not the average. Survival probability compounds control effectiveness across the covered steps.
Attackers cost the cheapest path, not the average, so a defence that hardens four of five steps and leaves one trivial has changed almost nothing.
This calculator takes 7 inputs: Steps from entry to the goal, Alternative techniques per step, Steps requiring several conditions together, Average attacker effort per step, Effort for the easiest technique at each step, Steps with a detective or preventive control, Average control effectiveness. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because path counts explode: 3^5 is 243 but 4^8 is 65,536. Bits (log₂) keeps the numbers comparable and lets you say plainly that one design is eight bits harder to attack than another.
Yes, from the defender's view. Each additional technique per step is another way through, which is why removing legacy protocols, unused interpreters and redundant admin paths is usually cheaper than defending them all.