What is calculated
Every path through the active attack steps that ends at a damage-bearing step becomes a risk. For each path, the engine takes the largest score for each of five factors along the path. Their sum gives the required attack potential (RAP) class. That class and the most severe damage linked to the path's final step select the risk in the model's matrix.
Initial risk = risk matrix [ damage level, RAP class ]
Residual risk = the same lookup after assigned measures and conditions change attack potential or damage
There is no multiplication of damage by a measured probability. RAP describes the capability an attacker needs to complete the path. The same complete inputs always give the same results.
Facts, model choices and decisions
Every result comes from three kinds of input. Keeping them apart lets a reviewer check each one against its own source.
Facts
What is true of the product: the answers to the questionnaire, the assets and interfaces, the measures and conditions that are assigned.
Given by the people who know the product.
Model choices
How facts become numbers: the factor scores of each attack step, the RAP classes, the risk matrix, the damage levels and the tolerance.
Set by the assessment's versioned model and catalogue, and reviewed with them.
Decisions
What a person decides about a result: accept, avoid, mitigate or transfer a risk, with a rationale, an owner and a review date.
Recorded by a named person; a decision does not change the calculation.
Assigned measures, treatment and tracing
Assignment credits a measure; it does not verify it
A countermeasure or condition assigned to an attack step raises that step's factor scores to the measure's contribution, where it is higher. Contributions are not added or treated as percentage reductions. Some measures also remove or replace damage scenarios. The result records what the residual risk relies on, not that the measure works or that the condition holds.
Automatic acceptance, or a recorded decision
The model accepts a residual risk automatically only if its value is strictly below the tolerance. At or above the tolerance, and on paths covered by a non-negotiable rule, the risk needs a recorded decision: accept, avoid, mitigate or transfer, with a rationale. A decision does not itself change the calculation.
Tracing
Tracing compares the full residual calculation with a rerun based on recorded confirmations. It shows which risks change when unconfirmed catalogue measures and conditions, and unconfirmed inline assumptions with IDs, are left out.
- Inline countermeasures, and legacy inline items without IDs, stay included.
- With no confirmations recorded, there is no comparison.
- Treatment proposals always use the full residual result, not the confirmed-only one.
A confirmation is a recorded assertion by a named person. The engine does not inspect evidence files.
Worked calculation
From the example assessment · Standard pack, model 1.0
Risk R9-40 of the example assessment: the path runs through AS9 (Attacking the product's internal gateway from the Internet) and AS40 (Abusing the lack of a software update functionality to exploit an unpatched vulnerability). The final step, AS40, is linked to disclosure of Personal data (significant) recorded by the product's cameras or sensors, DS1, damage level High.
1. Factor scores along the path
Catalogue estimates per step. A missing estimate counts as 0. The last row of each group holds the path maxima.
| Step or measure | ET | EX | KT | WO | EQ | Sum |
|---|---|---|---|---|---|---|
| AS9 Attacking the product's internal gateway from the Internet | 0 | 0 | 0 | 0 | 0 | 0 |
| AS40 Abusing the lack of a software update functionality to exploit an unpatched vulnerability | 4 | 6 | 3 | – | – | 13 |
| Path maxima | 4 | 6 | 3 | 0 | 0 | 13 |
| CM1 SCR 2.1 - Device Firewall | 1 | 6 | 3 | 10 | – | 20 |
| Path maxima with the measures | 4 | 6 | 3 | 10 | 0 | 23 |
AS9 Attacking the product's internal gateway from the Internet
- ET
- 0
- EX
- 0
- KT
- 0
- WO
- 0
- EQ
- 0
- Sum
- 0
AS40 Abusing the lack of a software update functionality to exploit an unpatched vulnerability
- ET
- 4
- EX
- 6
- KT
- 3
- WO
- –
- EQ
- –
- Sum
- 13
Path maxima
- ET
- 4
- EX
- 6
- KT
- 3
- WO
- 0
- EQ
- 0
- Sum
- 13
CM1 SCR 2.1 - Device Firewall
- ET
- 1
- EX
- 6
- KT
- 3
- WO
- 10
- EQ
- –
- Sum
- 20
Path maxima with the measures
- ET
- 4
- EX
- 6
- KT
- 3
- WO
- 10
- EQ
- 0
- Sum
- 23
ET elapsed time · EX expertise · KT knowledge of the product · WO window of opportunity · EQ equipment. CM1 is assigned to AS9, so it lifts AS9's scores; the path maxima then take the larger value on either step.
2. From the sum to a class
- ≥ 0Basic
- ≥ 10Enhanced-BasicInitial
- ≥ 14Moderate
- ≥ 20HighWith CM1
- ≥ 25Beyond High
3. Class and damage select the risk
The model's matrix row for damage level High.
| RAP class | Risk | R9-40 |
|---|---|---|
| Basic | Very High | |
| Enhanced-Basic | Very High | Initial |
| Moderate | High | |
| High | High | With CM1 |
| Beyond High | Moderate |
The model's risk levels, lowest first: Negligible · Low · Moderate · High · Very High.
4. Result and treatment
| R9-40 | Initial | With CM1 |
|---|---|---|
| RAP sum · class | 13 · Enhanced-Basic | 23 · High |
| Damage | High | High |
| Risk | Very High | High |
| Proposal | Manual | Manual |
| Recorded treatment | MitigateAlice · review by 30.10.2026 |
Tolerance is 3 on the risk scale (High). High is 3, so the risk needs a person either way. The conditions A46 and A47 are assigned to AS40 but contribute no factor scores; the change from Very High to High comes from CM1 alone.
Method foundations
The method's lineage runs through Modular Risk Assessment (MoRA), with attack-potential factors from the Common Criteria evaluation methodology. That lineage does not establish certification or independent validation of this application.
- The five factors and the sum-to-class bands
- CEM:2022, Annex B.6: the factors (elapsed time, expertise, knowledge of the target, window of opportunity, equipment) and the Basic through Beyond High bands. They express attack effort, not measured attack probability.
- Maxima along attack paths
- Angermeier et al., 2023, §5.2.1: MoRA's formally defined component-wise maximum along a path.
- Damage transformations and risk propagation
- The same paper describes their propagation; the functions from factors to feasibility, and from feasibility and impact to risk, remain choices of the assessment model.
- Catalogue estimates, matrix cells and acceptance rules
- These need their own rationale and review for the product in scope; the cited foundations do not validate this application's particular configuration.
The Standard model's option scale follows CEM v3.1 (2017), Table 3, the edition MoRA cites, and records no deviation from it. Where a model does depart from the reference scale, the model records the level it corresponds to and a rationale, and shows it in its editor. Opportunity "None" and Elapsed Time "Not exploitable" are worth the marker the engine treats as a path that is not exploitable: the path keeps its number and the top class, and carries the flag.
What the evidence establishes
It establishes
- Reproducible, specified behaviour: equal inputs give equal outputs, recorded by input hash.
- Which path, factor origins, damage and assignments produced each risk level.
- Which conditions the residual result relies on, and who has to fulfil each.
It does not establish
- Calibrated risk scores, or adequate catalogue coverage for a given product.
- That a credited measure is implemented or effective.
- That the product conforms to the CRA or to any standard.
Licences and attribution
| Asset | Licence | Attribution |
|---|---|---|
| Standard catalogue content | CC BY-SA 4.0 | QuBA-libre is Copyright (c) by Fraunhofer-Institut für Angewandte und Integrierte Sicherheit AISEC and SICK AG. All Rights Reserved. The upstream spreadsheet workbook (version 1.1.2) was imported into relational catalogs (questions, damage scenarios, attack steps, assumptions, countermeasures and standards) for use in this application, and its content was changed. Added: 28 questions (23 asked, 5 headings), 11 damage scenarios, 2 attack steps, 2 assumptions and 6 countermeasures; 18 attack steps read the added questions and two of them gain a trigger; 16 countermeasure-to-step links. Rewritten: 51 countermeasure descriptions (38 upstream references replaced by authored text, 13 upstream texts extended or reworded); 1 description added where upstream had none; the organisation placeholder has been made dynamic; the elapsed-time scale follows CEM v3.1 revision 5 with seven options (AS41's estimate is labelled ≤ three months); the first stakeholder and the stakeholder names of 16 assumptions are the organisation placeholder. Restored as framework bindings: the attack-step mappings to the CRA (24 attack steps, 33 letters). The help texts of the personal-data questions QI2 and QI11 are filed under the option each explains (only their keys moved). The lowest risk level is renamed 'Negligible' (formerly 'No Risk'). |