Skip to main content

Attack Path

According to ISO/SAE 21434, an attack path is the sequence of concrete, deliberate attack steps with which an attacker can realise a threat scenario — for example: compromising the telematics unit via the cellular interface, moving laterally onto the CAN bus, injecting manipulated messages to the brake ECU. The standard requires the possible attack paths to be analysed for every threat scenario; they are rated via the attack feasibility.

Top-Down and Bottom-Up

For the derivation, the standard names two approaches. Top-down, threat scenarios are systematically decomposed into the attack steps required to realise them; the most common tool for this are attack trees, which structure sub-goals, alternatives and dependencies via AND/OR nodes. Bottom-up, one starts from known vulnerabilities — for example from CVE reports or pentest results — and constructs which threat scenarios can be reached through them. In practice, both directions complement each other: top-down secures the completeness of the analysis, bottom-up anchors it in the real vulnerability landscape.

From Path to Risk

Each attack path is rated based on factors such as required time, specialist expertise, knowledge of the system, window of opportunity and equipment; this yields the attack feasibility level. Since an attacker chooses the most convenient way, the easiest path to carry out determines the rating of the threat scenario. Together with the impact level of the associated damage scenario, this yields the risk level via the risk matrix.

Attack Paths in Practice

Attack paths run along the channels and interfaces described by the Item Definition, and they cross component boundaries in doing so. This is exactly what makes maintaining them laborious: a new vulnerability in one component can change the feasibility on several paths at once, and in the best case a new control interrupts several paths at the same time. For analyses according to ISO/SAE 21434 that have to remain consistent over years, a model-based approach therefore proves its worth, with rating changes propagating along the paths instead of being updated by hand.

More on this topic

Related terms

Attack Tree Attack Feasibility TARA Threat Modeling

Frequently asked questions

How are attack paths derived?
The standard names two approaches: top-down, threat scenarios are systematically decomposed into the attack steps required to realise them — for example with attack trees. Bottom-up, one starts from known vulnerabilities and constructs which threat scenarios can be reached through them. In practice, both directions complement each other.
How are attack path and attack tree related?
The attack tree is a form of representation, the attack path the result: a route from a leaf to the root of an attack tree describes a complete attack path. Via AND/OR nodes, the tree records which steps have to be combined and which alternatives an attacker has.
Which attack path determines the risk of a threat scenario?
The easiest one to carry out. An attacker chooses the most convenient way to the goal, so the path with the highest attack feasibility determines the rating of the threat scenario. A control only lowers the risk if it makes all easy paths more expensive, not just one.
Reviewed by Jens Bühl, Product Owner on August 21, 2026