Mobile Attack Surface Risk Simulator

Attack Surfaces

Attacker

Attacker skill 1.0×

Total risk (0–10)

–

Surfaces mitigated

–

Breaches

–

Blocked

–

How it works

Each of the eight nodes is one OWASP Mobile Top-10 attack surface — insecure storage, weak cryptography, insecure network communication, reverse engineering of the binary, broken authentication, poor input validation, security misconfiguration and supply-chain (third-party SDK) risk. Every surface carries its own base exploit-likelihood and impact, independent of the others — a real app is not equally vulnerable everywhere. Applying that surface's specific mitigation multiplies its likelihood down; it does not touch any other surface's score.

risk(surface) = likelihood × (1 − mitigated·effectiveness) × attackerSkill × impact × 10
totalRisk = mean(risk(surface) for all 8 surfaces)

Attack particles spawn continuously from each node toward the core; a particle breaches with probability proportional to that node's current risk, and is deflected by a shield ring when the mitigation is active.
Attacker skill scales every surface's likelihood at once — a more capable attacker raises the floor everywhere, so mitigations matter more, not less.
Node radius and colour track its live risk score (green → amber → red), so the whole attack surface is readable at a glance even with all eight toggled independently.

Real-world relevance: this is the shape of an actual mobile app threat model — a portfolio of independent vulnerability classes, each needing its own fix, summed into one risk posture a security team reports on.

Low risk Medium risk High risk Blocked / deflected