How Good are Attack Trees for Modelling Advanced Cyber Threats

In this paper we present a study of the usefulness of attack trees for the modelling of advanced cyber threats. The study consisted of a case study where three cyber threats were modelled using attack trees and a judgement study where two cyber security experts were exposed to the attack tree models. We conclude that attack trees are not necessarily the best choice for modelling of advanced cyber threats.