Attack Tree Composer
Rate the Steps. See the Paths. Know the Risk.
Perform ISO/SAE 21434 attack tree analysis directly inside Polarion — build attack trees, rate attack feasibility, and document attack paths where your cybersecurity requirements already live.
What You Get
Everything your team needs to perform attack tree analysis without leaving Polarion.
ISO/SAE 21434 Attack Feasibility
Rate every attack step on the five attack potential parameters of Annex G. The composer sums the points, derives the feasibility class, and looks up the risk value from the Annex H matrix.
Attack Paths, Derived and Assessed
Every minimal combination of steps that reaches the attacker goal is listed with its derived rating. Assess a path as a whole, record the rationale, and let the threat scenario take the most feasible effective path.
Mitigation Guidance
See which attack step moves the goal the most when it is made infeasible, and put your cybersecurity controls where they count.
Native Polarion Integration
Every attacker goal, sub-goal, and attack step is a Polarion work item. Link cybersecurity requirements, controls, assets, and test cases directly in the tree, and reuse subtrees across documents.
Instant Visual Clarity
Build and navigate attack trees as clean, readable diagrams with the AND / OR refinement shown on every node. Automatic layout keeps even large trees organized.
Share with the Whole Team
Every Polarion user can view attack trees and attack paths at no extra cost. Editor licenses are only needed for the engineers who build and rate the analysis.
Attack Paths Documented on the Threat Scenario
ISO/SAE 21434 rates the attack path, and the threat scenario takes the most feasible one. The composer derives every path from the tree and writes them into a table on the attacker goal — a native Polarion table field that renders in the work item and in documents.
Derived, assessed, effective — each path shows the rating combined from its steps, the assessor's own rating when one is given, and the value that counts.
Assessments survive recomputation — rows are matched by their steps, so derived values refresh while assessed ratings and rationales stay.
Never stale by accident — a table that no longer matches the tree is flagged in the diagram and in the panel until you recompute.
Mitigation ranking — the steps ordered by what the goal's rating becomes if each one is made infeasible.
Attack Potential the Way the Standard Describes It
Elapsed time, specialist expertise, knowledge of the item, window of opportunity, and equipment — with the point scales, feasibility classes, and risk matrix of ISO/SAE 21434:2021. The assessment view shows the derivation parameter by parameter, so a reviewer can follow every number.
Configurable AND rule — weakest link as in SAE J3061, sum of all parameters, or sum of elapsed time with the maximum of the others.
Impact to risk — set the impact rating on the goal and the risk value follows from the Annex H matrix.
Classic method available — switch to Schneier attributes to rate attack cost and possibility and find the cheapest attack instead.
Built for Cybersecurity Engineers
Designed for the workflows and standards that matter most for connected products.
Threat Analysis and Risk Assessment
Meet the TARA requirements of ISO/SAE 21434 and UN Regulation No. 155 with attack trees that are fully integrated with your cybersecurity requirements, controls, and design data.
Change Impact in One View
Change a rating or a control, recompute, and see the new feasibility of every attack path and the new risk value of the threat scenario immediately.
Assessor-Ready Documentation
Attack trees, ratings, and the attack path table live in Polarion with full version history, review workflows, and traceability. When assessors ask for evidence, it is already there.
Configured Inside Polarion
Point the composer at your work item type and document type, choose the rating method, and let it create the custom fields and enumeration values it needs in your project. Every field can be mapped to an existing one instead, so the composer fits your information model rather than the other way around.
Reopen the configuration at any time to change the rating method, the AND combination rule, or the fields shown in the side panel. The settings are stored in the Polarion project, so every user of the extension works with the same setup.
Pricing
Attack Tree Composer is a separate product with its own license. Viewer access is included for every Polarion user; editor licenses cover the engineers who build and rate the analysis.
Request a Quote
Tell us the size of your Polarion installation and how many engineers will author attack trees, and we will send you a quote the same day.
Request PricingWhat's Included
Viewer access for your entire team
In-app configuration that creates the required fields in your project
Guided installation and onboarding
Priority support for critical issues
Regular updates and new features
Ready to bring your TARA into Polarion?
Join engineering teams who have replaced drawing tools and spreadsheets with attack trees that live next to their requirements.
Get Started