Attackability

Attackability is a concept used to describe the degree to which a target—such as a system, network, individual, or organization—is susceptible to successful attack. It reflects both the inherent vulnerabilities of the target and the feasibility of an attacker’s effort. In many domains, attackability functions as a composite metric that aggregates technical weaknesses, operational practices, and contextual factors that influence threat actors’ choices and capabilities.

In the field of cybersecurity, attackability typically combines known vulnerability scores, detection latency, configuration errors, and the skill set required for exploitation. Models such as CVSS provide component scores that can be weighted to compute an overall attackability rating. Security practitioners use these ratings to prioritize patching, hardening, and defensive layering. Similarly, penetration testers may develop attackability heat maps to highlight the most likely attack vectors in a network diagram.

Military and strategic studies also employ the term to assess the ease with which an adversary can penetrate physical defenses or disrupt command structures. Attackability assessments usually include assessments of perimeter security, redundancy, and the likelihood of information leakage. In cyber‑physical systems, attackability analysis examines the integration of digital controls with physical components, emphasizing the cascading effects that a successful compromise can have on safety‑critical processes.

Game‑theoretic approaches to attackability treat both defenders and attackers as rational agents choosing strategies to maximize benefit or minimize loss. These models often focus on equilibrium concepts where the defender invests in security controls to shift the cost curve above the attacker’s expected payoff. In this view, attackability is not static but evolves as attackers adapt and learning processes modify the probabilities of success.

Modern risk frameworks incorporate attackability into broader risk calculations. By quantifying the probability that an attack will succeed and the potential impact, organizations can allocate resources to mitigate high‑attackability components, thereby reducing exploitable surface areas. Attackability analysis remains an essential tool for anticipating threat actor behavior, prioritizing defenses, and mitigating the likelihood and consequences of attacks across cyber, physical, and strategic domains.