Your team's attack-tree nodes carry point costs like $180,000 that nobody can source. What do you change?
answer
- digits imply evidence nobody has
- resolution should match the source
- a few named bands, defined once
- record where each value came from
- bands compare, they do not add
basics
~20 sReplace unsourceable point figures with a few named qualitative bands and record where each value came from. A precise-looking number nobody can trace survives review because it has digits, and it makes a guess look like evidence.
solid answer
~50 sThe problem is not the size of the number, it is that $180,000 claims a precision the estimate does not have — nobody has ever priced jamming a satellite ground-station uplink, so the digits are decoration that will outlive the meeting and be quoted back as fact. I would move to a small ordinal scale with named anchors, for example low / moderate / high / state-level capability, defined once so different people apply them the same way. Bands are for comparing branches, not for arithmetic, and I would say so explicitly. Alongside each value I record its basis: a historical incident cost, a red team's actual hours, a market price for a service, or "engineering judgment, no source". Where a real range exists I write the range. Point numbers stay only where the value is genuinely purchased at a known price.
go deeper
Know that a precise-looking figure on a threat model is often a guess in disguise, and that asking where a number came from is a legitimate and expected question.
Explain what false precision is and give the alternative: a small ordinal scale with written anchors, plus a recorded basis for each value. Know that bands are for comparison, not arithmetic.
Be able to grade the sources — measured red-team effort and historical incident cost beat unvalidated judgment — and to say what you write on a node when only a guess exists.
Own the scale itself: define the bands and the basis field for the whole programme, migrate existing trees rather than running two conventions, and defend the change to stakeholders who preferred the numbers.
## The failure being fixed False precision is when a value is expressed to a resolution the underlying evidence cannot support. A node reading `$180,000` on a branch for disrupting a satellite ground-station uplink asserts that someone priced the RF equipment, the operator time, the site access and the failure rate, to a resolution of ten thousand dollars. Usually nobody did. The figure was an hour's guess, and once it is on the diagram it acquires the authority of a measurement: it gets copied into a slide, compared against a control's budget, and defended in a meeting where the person who invented it is not present. The damage is specific. Precise numbers **win arguments they have not earned** against qualitative statements that are better supported, and they suppress the question "where did that come from?" precisely because a rounded band would have invited it. ## Qualitative bands The alternative is a short ordinal scale per attribute, with named anchors written down once: - **Attacker capability / skill** — low (a competent generalist), moderate (a specialist in this technology), high (a small funded team with prior access to the domain), state-level (sustained resources, custom equipment, no meaningful budget limit). - **Elapsed time** — hours / days / weeks / months. - **Monetary cost** — under a thousand / thousands / hundreds of thousands / effectively unbounded. Three to five bands is the working range: fewer and everything piles into the middle, more and the boundaries stop being defensible. The anchors matter more than the labels — "moderate" means nothing until it names the kind of person who clears the bar. Two properties of bands must be stated to the readers, because they are the source of the next mistake: 1. **Bands are comparative, not arithmetic.** "Moderate" is greater than "low"; it is not twice it. Do not average bands, and do not silently convert them to 1-4 and start doing sums. 2. **A band is still an estimate.** Moving from digits to words removes false precision, not uncertainty. ## Sourcing the estimates A band with no provenance is only a smaller guess. Record the basis next to the value. In practice most values come from one of four places, and they are not equally strong: - **Historical incident cost.** What this class of attack actually cost the organisation, from its own records — strong for anything that has happened before, such as a bank pricing card-fraud branches from its own recovery figures. - **Measured effort.** A red team's real hours and equipment on this system, converted honestly. The strongest source available, and the reason to feed offensive testing results back into the trees rather than filing them. - **A market price for a service.** Where an attacker can buy the step outright, the going rate is a real number, and this is one of the few places a point figure is legitimate. - **Engineering judgment.** Someone who knows the system, guessing. Perfectly acceptable, provided it is labelled as that. When only a guess exists, write the band, write "judgment, unvalidated", and name the person. That costs nothing and changes how the value is read a year later. Where an honest range exists, write the range rather than its midpoint — a midpoint discards the fact that the estimate spans an order of magnitude. ## What survives as a point number Do not overcorrect into all-words. A point figure is right where the value is genuinely a price someone pays: rented compute, a piece of hardware with a catalogue price, a purchased credential set. The rule is the resolution of the evidence, not a preference for prose. ## Making the change stick As a programme decision: define the bands once, in the same place as the attribute set, so trees from different teams remain comparable; require a basis field alongside every annotation; run a pass over the existing trees converting unsourceable point figures rather than leaving two conventions in circulation; and review the values on a cadence, because capability estimates decay downward as techniques spread. Expect resistance from stakeholders who liked the numbers — the honest answer is that the old figures did not contain the information they appeared to contain, and the band plus its basis is a truthful statement of what is actually known.
- Is there anywhere a point figure is still the right annotation?Yes, wherever the attacker simply buys the step at a known price: rented compute, catalogue hardware, a service with a going market rate. There the digits reflect a real quote and the resolution is honest. The test is always whether the evidence supports the resolution, not whether words are safer than numbers.
- A stakeholder says bands are too vague to make a funding decision on. How do you answer?That the old figure was not less vague, only better disguised, and that a decision made on an invented number is not better supported for looking precise. Then make the band actionable: name the anchor, show the basis, and if the funding call genuinely hinges on the value, buy a better estimate — a scoped red-team exercise on that branch — rather than inventing digits.
- How do you keep bands from drifting between two teams?Write the anchors down as descriptions of who or what clears each bar, not adjectives, and keep one shared definition rather than per-team copies. Calibrate occasionally by having both teams band the same handful of reference nodes and comparing; disagreement on a reference node is a definition problem, not a personality one.
It is the difference between a survey and a sketch map. A sketch map drawn to scale, with contour lines, is more dangerous than one that is obviously a sketch, because people navigate by it.
saying these in an interview costs you the question
- Defends a figure because it is on the diagram
- Treats ordinal bands as numbers to average
- Converts every guess to a midpoint point value
- Records no source for any estimate
- Thinks removing digits removes the uncertainty
- Uses bands with no written anchor definitions