3D Mobile Attack Surface Arena

Attack Surfaces

Attacker

Attacker skill 1.0×

Total risk (0–10)

–

Surfaces mitigated

–

Breaches

–

Deflected

–

How it works

Eight pylons ring the app core, one per OWASP Mobile Top-10 attack surface. A pylon's height and glow track its own live risk score — likelihood × impact, scaled by the attacker's skill and cut down by that surface's specific mitigation when active. Streams of attack particles launch continuously from every pylon toward the core; each one resolves independently, breaching straight through an unmitigated surface or curving off a shield ring that snaps into place the instant its mitigation is toggled on.

risk(surface) = likelihood × (1 − mitigated·effectiveness) × attackerSkill × impact × 10
pylonHeight ∝ risk(surface),  shield visible ⟺ mitigated

Drag to orbit, scroll to zoom — the shield rings and pylon heights read from any angle, so you can see all eight surfaces' posture at once.
Toggling one mitigation only changes its own pylon — the others keep their independent risk, just like a real threat model where fixing storage encryption does nothing for a broken TLS pinning check.
Attacker skill raises every surface's likelihood together, showing why layered mitigation across all eight matters more against a stronger adversary, not less.

Real-world relevance: security teams score mobile apps exactly this way — a per-category risk register, not a single pass/fail — and this arena is that register made spatial.

Low risk pylon Medium risk pylon High risk / breach Shield / deflected

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.