Informed Defense: How Attacker Profiles Transform Vulnerability Assessments

In the face of an evolving and increasingly complex threat landscape, organizations must adopt proactive approaches to assess and improve the resilience of their IT infrastructures against potential adversaries. Attack graphs are an effective tool to illustrate adversarial actions, but they often fail to capture the decision-making process of adversaries. To address this limitation, we map MITRE techniques to the attack steps in the attack graph and weight attempt probabilities at decision points according to the threat profile of the attacker. Considering a realistic, large IT infrastructure, we analyze how variations in attacker decision-making impact success rates, path diversity, the most frequent paths, and applied techniques. Our findings show that integrating attacker profiles into threat modeling can support accurate identification of the threat landscape and the optimization of defense strategies.