Study
Innovation & DesignNew This WeekStrong effect

Quantifying Cyber Attack Campaign Likelihood for Prioritized Defense

A data-driven framework using attack trees and cATM logic can quantitatively assess and compare the likelihood of cyber attack campaigns, enabling more effective prioritization of defensive strategies.

ACM Transactions on Software Engineering and Methodology · 2026

01

Key Findings

  • 01The proposed methodology is substantially lighter in modeling effort compared to manual approaches.
  • 02The framework is capable of capturing all quantitatively relevant data for attack campaign comparison.
  • 03The data-driven approach allows for quantitative comparison of attack campaign likelihoods.
02

Application

Design takeaway

Designers and engineers should adopt quantitative methods, like the one presented, to assess and prioritize cyber threats, moving beyond subjective evaluations to data-informed decision-making.

How to apply

Utilize the principles of attack tree modeling and quantitative likelihood assessment to evaluate the risks associated with different design choices or potential failure modes in a system.

Project actions

  • 01When analyzing potential threats to your design, consider how you can assign quantitative values to different attack vectors.
  • 02Explore tools or methods that can help you model complex systems and their vulnerabilities systematically.
03

Method & Evidence

AimCan a data-driven framework using attack trees and cATM logic quantitatively assess and compare the likelihood of cyber attack campaigns to inform defensive prioritization?
MethodQuantitative analysis and framework development
ProcedureThe study developed a framework to quantify the likelihood of cyber attack campaigns by leveraging the MITRE knowledge-base. This involved creating a methodology for automatic modeling of intelligence data into template attack trees and using cATM logic for comparison. The framework was then used to quantify all MITRE Enterprise campaigns and compare specific campaigns against manually built models.
ContextCybersecurity threat assessment and defense strategy

Variables

IV["Attack campaign data (MITRE knowledge-base)","Attack tree models","cATM logic"]
DV["Quantified likelihood of attack campaigns","Comparison of attack campaign likelihoods"]
CV["MITRE Enterprise campaigns","Manual attack tree models (for comparison)"]
04

Strengths & Limitations

Strengths

  • +Provides a quantitative and data-driven approach to cyber threat assessment.
  • +Offers a methodology that is lighter in modeling effort compared to traditional methods.

Limitations

The accuracy of the quantitative assessment is dependent on the quality and completeness of the data used (e.g., MITRE knowledge-base). Real-world attack scenarios can be more complex and unpredictable than modeled.

Reliability & validity

The reliability of the framework's output depends on the consistency of the data inputs and the modeling process. Validity is supported by comparison with manually-built models, but further expert validation is recommended.

Think critically

How might the 'lighter modeling effort' claimed by the authors be achieved in practice, and what are the potential trade-offs in terms of model fidelity or comprehensiveness?

05

Design Principles

"Quantify and compare risks using structured data models to inform strategic design decisions."

In the face of sophisticated and evolving cyber threats, design and engineering teams need robust methods to evaluate risks. This research provides a structured approach to move beyond qualitative assessments, allowing for data-informed decisions on where to allocate resources for maximum impact in cybersecurity.

06

What This Means for Your Design

This research shows how to use a smart system to figure out how likely different cyber attacks are, so people can focus on defending against the most dangerous ones first.

How to use in your project

  • 1.Reference this study when discussing the methodology for evaluating the risks and potential impacts of different design choices or user interactions.
07

Add to My Project

08

Quick Cite

(2026). How Hard Can It Be? Quantifying MITRE Attack Campaigns with Attack Trees and cATM Logic. ACM Transactions on Software Engineering and Methodology. https://doi.org/10.1145/3789665 Retrieved from https://designdex.org/study/6207ad7f-b07c-4086-88ef-5eda726bc8db/quantifying-cyber-attack-campaign-likelihood-for-prioritized-defense

Paragraph starter

This research by Nicoletti et al. (2026) offers a valuable framework for quantitatively assessing and comparing the likelihood of cyber attack campaigns. By employing attack trees and cATM logic, their data-driven approach enables a more systematic and efficient prioritization of defensive strategies, which is directly applicable to evaluating potential risks and vulnerabilities within complex design projects.

09

Source

ACM Transactions on Software Engineering and Methodology

How Hard Can It Be? Quantifying MITRE Attack Campaigns with Attack Trees and cATM Logic

journal · 2026

View source

Questions about this research

What does the research say about quantifying cyber attack campaign likelihood for prioritized defense?
Designers and engineers should adopt quantitative methods, like the one presented, to assess and prioritize cyber threats, moving beyond subjective evaluations to data-informed decision-making. Evidence: ACM Transactions on Software Engineering and Methodology (2026).
Why does "Quantifying Cyber Attack Campaign Likelihood for Prioritized Defense" matter for design?
In the face of sophisticated and evolving cyber threats, design and engineering teams need robust methods to evaluate risks. This research provides a structured approach to move beyond qualitative assessments, allowing for data-informed decisions on where to allocate resources for maximum impact in cybersecurity.
How can designers apply this research?
Designers and engineers should adopt quantitative methods, like the one presented, to assess and prioritize cyber threats, moving beyond subjective evaluations to data-informed decision-making.
What were the main findings?
The proposed methodology is substantially lighter in modeling effort compared to manual approaches.. The framework is capable of capturing all quantitatively relevant data for attack campaign comparison.. The data-driven approach allows for quantitative comparison of attack campaign likelihoods.
What research method was used?
Quantitative analysis and framework development.
How strong is the evidence?
Evidence strength is rated Strong effect, based on a 2026 journal from ACM Transactions on Software Engineering and Methodology.
What should I do differently in my next project?
Utilize the principles of attack tree modeling and quantitative likelihood assessment to evaluate the risks associated with different design choices or potential failure modes in a system.
What are the limitations?
Further validation with cybersecurity experts and sourcing more manually-built models are recommended for broader applicability.
Is there evidence that cyber attack affects design outcomes?
The research successfully developed a framework that makes it significantly easier and more efficient to quantify and compare the risks posed by different cyber attack campaigns, providing valuable data for defense planning. In the face of sophisticated and evolving cyber threats, design and engineering teams need robu Source: ACM Transactions on Software Engineering and Methodology (2026).
Where does this attack campaigns research apply?
Cybersecurity threat assessment and defense strategy It sits within innovation & design research on designdex.org.

Related research topics

cyber attack design research · evidence on cyber attack · does cyber attack improve design outcomes · attack campaigns studies for designers · cyber attack and attack campaigns findings · innovation & design research evidence