Attack Path

Set of deliberate actions to realize a threat scenario. Name the attack path after the threat source, threat vector, and situation.

Attack Path Steps

Enumerate each step needed to perform the threat scenario.

Attack Feasibility Rating

An attribute of an attack path describes the ease of successfully carrying out the corresponding set of actions. By default, the ISO/SAE 21434:2021 rating scale is used.

Creating a Simple Attack Path

A Simple Attack Path refers to the manual way of describing and rating the feasibility of attack paths. It does not refer to potential based attacks or CVSS methodologies.

To create a Simple Attack Path


  1. In the Containment tree, right-click Attack Paths and Feasibility Ratings and select Create Element.



  2. Do one of the following:
    • In the dialog, expand ISO 21434 and select Simple Attack Path.



    • In the search tab, type the keyword attack and then select Simple Attack Path.



  3. Name the created Simple Attack Path in the Containment tree and press Enter. The Simple Attack Path has the suffix SAP, which denotes that the created element is a Simple Attack Path; the number 1 indicates that it is the first Simple Attack Path created.


Creating a Simple Attack Path Table

To create a Simple Attack Path Table


  1. In the Containment tree, right-click Attack Paths and Feasibility Ratings and select Create Diagram.



  2. Do one of the following:
    • In the dialog, expand ISO 21434 and select Simple Attack Path Table.



    • In the search tab, type the keyword attack and then select Simple Attack Path Table.



      The Simple Attack Table is displayed in the diagram pane of the modeling tool.

Adding a Simple Attack Path to Simple Attack Path Table

To add a new Simple Attack Path to the Simple Attack Path Table


  1. In the Simple Attack Path Table, click Add New. A row is added in the Simple Attack Path Table, which shows the new Simple Attack Path.



  2. In the newly created Simple Attack Path's row and the Name column, double-click the designated cell to name the Simple Attack Path.



To add an existing Simple Attack Path to the Simple Attack Path Table


  1. In the Simple Attack Path Table, click Add Existing.



  2. From the Select Attack Path dialog, select the required Simple Attack Path. A row is added to the Simple Attack Path Table, which shows the existing Simple Attack Path.



  3. In the existing Simple Attack Path's row and the Name column, double-click the designated cell to rename the Simple Attack Path.


Adding Attack Path Steps

To add Attack Path Steps to the Simple Attack Path Table


  1. Double-click the designated cell in the Attack Path Steps column and the required Simple Attack Path's row and click .



  2. From the Select Situation dialog, select Attack Path Steps.



    The Attack Path Steps now shown in the Simple Attack Path Table.

  • You can also drag and drop the Attack Path Step from the Containment tree to the Threat Scenario Table.
  • You can move the Attack Path Steps in the Select Situation dialog by clicking Up or Down.


Adding an Attack Feasibility Rating

To rate the Attack Feasibility


  • Double-click the cell in the Simple Attack Path's row and from the drop-down list, select Attack Feasibility Rating.



    The Attack Feasibility Rating is now shown in the Simple Attack Path Table.

Simple Attack Path Table Example