Attack Tree Threat Modeling for Med Devices | Blue Goat

Part of our FDA 2026 medical device cybersecurity submission series. For the full overview, start with FDA Cybersecurity Requirements for Medical Devices (2026).

Reviewed September 17, 2026

Choosing the wrong threat modeling method wastes engineering time and produces documentation that reviewers still send back with questions. Teams that jump straight into an attack tree without first scoping the device's threat surface often build detailed diagrams for the wrong attack goals, while teams that stop at a high-level STRIDE pass never generate the concrete exploit paths a security risk file needs. Both mistakes are common in medical device programs racing toward a submission deadline. The right approach usually combines methods: a broad technique to find the threat surface, then attack trees to work out how the highest-risk threats could actually be carried out. This piece compares attack trees against threat trees, STRIDE, and FMEA, explains when each is worth the effort, and walks through how attack tree output becomes usable ISO 14971 risk analysis and FDA-facing documentation.

Why This Matters

Threat modeling method choice has direct consequences for both product security and regulatory timelines. A device team that skips structured attack modeling for a high-risk function, such as remote infusion pump control, risks discovering exploitable gaps only after a penetration test, when redesign is far more expensive than it would have been earlier. Reviewers evaluating premarket submissions increasingly ask pointed questions when a security risk assessment lacks traceable reasoning from threat identification to mitigation.

Attack tree threat modeling gives that traceability by forcing the team to articulate exactly how an attacker would move from initial access to a harmful outcome. This level of detail is what allows a risk analysis to assign meaningful probability and severity ratings instead of generic high, medium, or low labels that do not hold up under scrutiny. It also gives penetration testers a concrete scope: instead of testing everything shallowly, they can validate whether the specific paths identified in the tree are actually exploitable.

Getting the method selection right, using attack trees where they add value and lighter methods where they do not, keeps engineering effort proportional to actual patient risk. That proportionality is exactly what the FDA's current premarket guidance expects manufacturers to demonstrate.

What Is Attack Tree Threat Modeling?

Attack tree threat modeling is a structured technique that starts from a single adversary goal and decomposes it into the specific steps required to achieve it. The root node represents the harmful outcome, such as "deliver unauthorized medication dose," and child nodes represent the individual actions or vulnerabilities an attacker would need to chain together.

Each branch can carry attributes like cost to the attacker, required skill level, or likelihood of detection, which helps prioritize which paths deserve mitigation first. [KEY REQUIREMENT] Every leaf node in a medical device attack tree should tie back to a concrete, testable condition, such as a specific unauthenticated API call, not a vague statement like "attacker gains access."

Attack Trees vs. Threat Trees

The terms are often used loosely, which causes confusion during documentation review. A threat tree, in the broader sense some teams use, identifies categories of threats and weaknesses across a system without necessarily detailing the exact steps to exploit each one.

An attack tree, by contrast, is tactical: it maps the specific sequence of actions from initial foothold to final impact. In practice, an attack tree is often built as a deeper elaboration of one branch identified during a broader threat identification pass.

Attack Trees vs. STRIDE vs. FMEA

STRIDE, FMEA, and attack trees each answer a different question, and confusing their purposes is a common source of wasted effort. STRIDE categorizes threats by type, spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, applied against data flow diagrams. FMEA (Failure Mode and Effects Analysis) originated in reliability engineering and asks how a component could fail and what the downstream effect would be, whether the cause is malicious or accidental.

Attack trees ask neither of those questions directly; they ask "how, specifically, could someone reach this bad outcome." Used together, STRIDE or FMEA surface the threat surface broadly, and attack trees drill into the highest-priority items.

When Is Building an Attack Tree Worth It?

An attack tree is worth building for any function where a successful compromise could cause serious patient harm or a major data breach, such as therapy delivery, dosing control, or PHI storage. It is generally not worth the effort for low-risk, non-safety features where a simpler entry in a threat list is sufficient documentation.

Teams under submission time pressure should prioritize attack trees for the two or three highest-risk functions identified during initial threat surface analysis, rather than attempting exhaustive trees for every feature. Depth matters more than breadth for these diagrams.

See also: Home Use vs Hospital Device Cybersecurity Requirements, Security Architecture Views: The FDA's Four Required Diagrams, and FDA AI Cybersecurity Threats: 7 Attacks.

Teams sometimes discover mid-project that the attack tree they built assumed an outdated architecture, since firmware or network topology changed after the initial diagram was drafted. Revisiting the tree whenever the device's connectivity or authentication model changes keeps the documentation aligned with what actually ships.

How Attack Tree Output Feeds ISO 14971 Risk Analysis

Each leaf node and path in an attack tree maps to inputs an ISO 14971 risk analysis needs: a hazardous situation, an estimate of probability of occurrence, and an estimate of severity of harm. The number of steps and the skill level required in an attack path give a defensible basis for the probability rating, rather than an unsupported guess.

The mitigations identified for each branch become the risk control measures documented in the risk management file, and the residual risk after mitigation gets re-evaluated the same way. [KEY REQUIREMENT] The FDA's February 3, 2026 final guidance expects this chain of reasoning, from identified threat through documented mitigation to residual risk, to be traceable, even though it does not mandate the attack tree diagram format itself.

Worked Example Structure

A worked attack tree for a connected infusion pump might use "deliver unauthorized medication dose" as the root goal, illustrating the structure without asserting any real product's actual vulnerabilities.

• Root goal: Deliver unauthorized medication dose
  • Branch 1: Compromise wireless communication
    • Intercept unencrypted configuration traffic
    • Replay captured dosing command
  • Branch 2: Exploit local authentication
    • Use default or weak service credentials
    • Bypass session timeout on maintenance interface
  • Branch 3: Tamper with firmware update process
    • Submit unsigned or improperly validated firmware image

Each branch would then be assigned an estimated attacker skill level and detectability, which feeds directly into the probability rating used in the corresponding ISO 14971 entry.

How Blue Goat Cyber Approaches This

Blue Goat Cyber builds attack trees for the specific high-risk functions in a device rather than attempting exhaustive coverage of every feature, keeping engineering effort proportional to actual patient risk. This work starts with broad threat surface identification, then focuses tactical attack tree development on the functions most likely to cause harm if compromised, such as therapy delivery or credential-protected configuration interfaces.

The resulting attack paths are handed directly to penetration testers to validate whether the identified steps are actually exploitable, and the findings are documented in a format that traces cleanly into an ISO 14971 risk management file. Manufacturers preparing for premarket review can learn more about how this fits into a broader security strategy through our medical device threat modeling services.

Frequently Asked Questions

What is attack tree threat modeling?

Attack tree threat modeling is a technique that starts from a specific adversary goal and breaks it into the individual steps needed to achieve it. Each branch represents an action or vulnerability, and the tree helps teams prioritize which exploit paths pose the greatest risk.

How is an attack tree different from STRIDE?

STRIDE categorizes threats by type across a system's data flows, while an attack tree maps the specific sequence of steps toward one adversary goal. Many teams use STRIDE first to find the threat surface, then build attack trees for the highest-risk items identified.

Does the FDA require attack trees for premarket submissions?

The FDA's current guidance does not mandate a specific diagram format like attack trees, but it does expect documented, traceable reasoning from identified threats through mitigations to residual risk. Attack trees are a common and effective way to demonstrate that reasoning.

When should a team use FMEA instead of an attack tree?

FMEA is better suited to evaluating how a component could fail, whether from a malicious act or an accidental fault, and what the downstream effect would be. Attack trees are better suited to modeling a deliberate, multi-step adversary attempt to reach a specific harmful outcome.

How does attack tree output connect to ISO 14971?

Each attack path gives a basis for estimating probability of occurrence based on required attacker skill and detectability, and the harmful outcome at the root supports the severity estimate. These estimates and the mitigations tied to each branch become entries in the ISO 14971 risk management file.

CTA

Need attack tree threat modeling that holds up under FDA review and feeds directly into your risk management file? Blue Goat Cyber can scope the highest-risk functions in your device and build the documentation to support it. Schedule a discovery session to get started.

Related on threat modeling

• STRIDE threat modeling for medical devices: the complete playbook
• STRIDE vs DREAD vs PASTA: which threat model fits medical devices?
• Step-by-step threat modeling for connected & implantable devices