IT and security / Free editable template

Attack tree diagram template

An attack tree breaks one attacker goal into the different ways it could be reached, so you can see which defences matter most. This example takes access to a customer database as the goal and splits it into stolen credentials, a web app exploit and an insider, using AND and OR gates, with a likelihood and a blocking control on every leaf.

Use this template →See the example ↓

No account needed · Opens as your own editable page

Preview the attack tree diagram

View full-size preview ↗
Attack tree diagram example showing goal broken into three attack paths, and and or gates, likelihood and control on each leaf
Everything in this example is editable. Replace the labels, move the shapes and adapt the layout to your work.

How to use this template

  1. Start with one goal

    Write the attacker's goal at the top in plain words, such as access the customer database or stop the payment system.

  2. Branch until it is concrete

    Keep breaking each path down until the leaves are specific actions an attacker would take. Use AND when all children are needed and OR when any one is enough.

  3. Rate and defend

    Mark each leaf's likelihood and the control that blocks it. Leaves with high likelihood and no control are where to invest.

Questions about this template

What is the difference between the AND and OR gates?

Under an AND gate every child must happen for the attack to work. Under an OR gate any one child is enough, so each of those branches usually needs its own control.

Do I need an account to use it?

No. Open the template and edit it in your browser. Your work saves on this device. An account is optional if you want to sync your workspace.

Can I export the finished diagram?

Yes. Use Export in the editor to save a PNG, SVG or PDF, or download an editable .epicdraw backup.

More IT and security templates →