Attack Paths
An Attack Path represents a plausible route by which an attacker could realize a threat. It is composed of one or more Attack Steps. An attack path has no name. Its feasibility derives from its steps unless you give it a direct Feasibility rating (see How feasibility works).
List View
Attack paths are reached from a threat scenario in the Threat Library (Libraries → Threat Library). The Attack Paths list shows every path in the library.
The table shows each path’s Attack Path (its description, with the auto-generated AP-xxx reference underneath), Feasibility, Used by (how many threat scenarios use it), Attack Steps (reference chips), and an Actions column. Click the description to open the detail page.
- Create: click Add attack path in the header. The New Attack Path dialog has a required Description plus optional Example and Feasibility rating. Steps are added on the path’s detail page once it exists. The reference is auto-generated; there is no reference input.
- Delete — click the delete icon in the Actions column; a confirmation dialog appears before permanent removal.
Detail Page
Click a path’s description in the list to open its detail page. A Return to Attack Paths link navigates back to the list.
Details
| Field | Description |
|---|---|
| Reference | Auto-generated identifier (e.g. AP-001) |
| Description | Free-text explanation of how the attack proceeds (required) |
| Example | Illustrative example of the path in action |
| Feasibility | The path’s direct Feasibility rating when one is set, otherwise the feasibility derived from its steps |
Attack Steps
Lists the Attack Steps that make up this path, in order. Add, remove, and reorder steps here. Click a step to navigate to the Attack Step detail page.
How Feasibility Works
The five ISO/SAE 21434 attack-potential factors (Elapsed Time, Specialist Expertise, Knowledge of Item/Component, Window of Opportunity, and Equipment) are entered on the individual Attack Steps. When scoring a risk, VSEC adds up the attack-potential points of the steps in each linked path and turns the total into a feasibility band; a path with no scored steps counts as High. If a path has a direct Feasibility rating, that rating is used instead of its step total. The path with the highest feasibility band, the easiest one for an attacker, drives the risk’s Likelihood.
Editing
Click Edit on the detail page to open the path in a modal form dialog. Click Save Changes to persist or Cancel to discard.