In an attack tree, why does propagating cost and time separately give an unreal path?

## The failure Cheapest-path propagation is defined for **one** attribute at a time: sum it at AND, minimise it at OR. Nothing in that definition says the winning child at an OR node is the same child for every attribute. Run the machinery independently over money, hours, skill and detectability, and each column's minimum can be contributed by a different branch. The root then holds a **synthetic profile** — the cheapest money, the shortest time, the lowest skill — that corresponds to no path in the tree and to no attack a human could execute. ## Worked case: medication-order integrity A hospital, asset patient safety, goal "cause a patient to receive an order they were not prescribed". Two branches under one OR: | Branch | Money | Hands-on time | Access required | | --- | --- | --- | --- | | Forge prescriber credentials and submit remotely | substantial | minutes | none physical | | Enter as agency staff, alter an order at an unattended ward workstation | near zero | hours of unobserved presence | on-ward physical | The adversary of the second branch is a visitor or agency staffer; of the first, a remote actor with money. Minimising per column produces "near-zero money, minutes of time, no physical access" — better than either real option on every axis, and available to nobody. Presented to a clinical safety review, that root is worse than no number, because it invites controls aimed at an attacker who does not exist. ## Why it happens so easily - **The operators are seductive.** Summing four columns through an AND and minimising four columns through an OR is one loop over an array; nothing errors. - **Units are incommensurable.** Hours and currency have no exchange rate until someone declares one, and a declared rate is a modelling assumption that deserves to be visible. - **Some attributes are not costs at all.** Required privilege level or physical access are *gates*: you either have them or you do not. Minimising a gate as if it were a quantity is meaningless. - **Some attributes compose differently.** Detection probability does not sum. For two independent steps of an AND node each carrying a 0.2 chance of being noticed, the chance of being noticed overall is 1 − (0.8 × 0.8) = 0.36, not 0.4. And the attacker minimises detection at OR, which may select a different branch again. - **Ordinal annotations do not add.** If a leaf is labelled "medium" rather than given a number, the sum at an AND node has no defined result, and the comparison at an OR node only supports an ordering, not arithmetic. ## Four ways to keep the root real 1. **Propagate paths, not numbers.** Carry the whole annotation tuple together with the identity of the child that won. At an OR node you choose one child *by a stated criterion* and inherit all of its attributes, including the unflattering ones. The root then names a branch and reports that branch's full profile, which is checkable by a reviewer who knows the system. 2. **Gate first, minimise second.** Fix an adversary profile — anonymous remote actor, on-site agency staffer, bribeable operator, compromised vendor — and prune every branch whose access or skill requirement the profile cannot meet. Only then minimise on a single attribute. This turns "skill" and "required access" from fake costs into what they actually are: feasibility conditions. 3. **Answer per profile, not per tree.** One tree, several roots. The on-ward profile's cheapest path is the workstation branch; the remote profile's is the credential branch. Two honest answers beat one averaged fiction, and the difference between them is often the most useful output of the exercise. 4. **Scalarise only with declared weights.** If a single figure is genuinely required, combine attributes with an explicit weighting — an hour of unobserved presence valued at some stated rate — and print the weights beside the result. The number then survives challenge, because the arguable part is on the page instead of buried in a spreadsheet. ## What a strong answer sounds like Say plainly that the arithmetic is valid per attribute and invalid across attributes; give a concrete pair of branches where the argmin differs by column; and land on the remedy — keep the path attached to the numbers, treat access and skill as gates, and answer once per adversary profile. Candidates who instead propose normalising every attribute to a 1–5 scale and adding them up have reproduced the original defect with more decimal places: the sum is still combining branches nobody can combine, and now the weighting is implicit at 1:1 rather than argued.