This system provides our approach to model risk by utilizing Attack Flow. This is our preferred method for visualizing and understanding potential attack paths in your organization’s security infrastructure.

Attack Flow is an easy and effective way to help security teams to see how various vulnerabilities and threats could be exploited in sequence, offering a dynamic view of potential attack paths.

1. Why we believe using Attack Flow is a good idea

After creating and visualizing numerous scenarios for dozens of clients we concluded that there are no perfect visualization tools to start with.

There's just more solutions that work for specific use cases.

This led us to exploring Attack Flow from the Center of Threat-Informed Defense.

It was released a while back, but we found that it actually fits a lot of the criteria we have:

• You can instantly start loading attack path content in the solution.
• It's relatively low fidelity and easy to learn.
• You can use the solution online to create a private, internal instance using Docker. ● It provides different levels of abstraction.
• It provides the option to differentiate between technical details (e.g. STIX) and technique level elements (e.g. MITRE ATT&CK).
• It provides an export to JSON option.
• It provides export to GraphViz & Mermaid option; very useful if you want to build Attack Trees.
• It looks great on a virtual presentation or in your deliverables.

Here's what it looks like:

2. Key elements to success

A fool with a tool is still a fool.

We compiled lessons learned that you need to think about up-front, before you even consider visualizing anything.