3.3 — Ecosystem measures
Risk treatment for attack paths going through a stakeholder. This is the "ecosystem" side of Workshop 3: reducing the threat posed by a third party, rather than hardening your own system.
Scope
Only "Via stakeholder" paths are covered
This page only handles attack paths of type Via stakeholder, defined in 3.2. A direct path offers no leverage over the ecosystem — the page states this explicitly.
Three views
| Tab | Use |
|---|---|
| By strategic scenario | Work path by path, with the residual graph |
| All measures | Consolidated view, for tracking |
| Comparative radar | Stakeholder position before / after measures |
A View / Edit toggle lets you freeze the display during a presentation.
What a measure covers
Stakeholder concerned, the rating parameter it shifts, status, owner and deadline.
The effect of measures
Each measure acts on the stakeholder's rating — this is what moves its current criticality down to a residual threat level, and shifts its position on the radar of workshop 3.1.
The residual graph shows, for the selected scenario, the recalculated likelihood once measures are applied.
Show the gaps
The "Scenarios/paths without a measure" option reveals untreated paths. This is the workshop's completeness check: a path via a stakeholder with no measure at all is either an oversight or an accepted risk that should be justified.