Targeted Attack Feasibility is the judged likelihood that a specific attacker can successfully compromise a defined asset or function. It combines the attacker’s capability, access, cost, time, and exposure of the target, and is often used to prioritise controls and testing effort in threat analysis.
What Targeted Attack Feasibility Means
Targeted attack feasibility is not just “can this be attacked”, but “can a particular adversary succeed here under realistic constraints”. It reflects the difference between a theoretical weakness and a practical compromise path, so it is most useful when a team needs to judge which assets deserve immediate attention and which threats are likely to be credible.
Because the metric is attacker-specific, it naturally includes the adversary’s capability, proximity, tooling, patience and need for pre-positioning. A low-feasibility target may still be worth monitoring, but it usually sits lower in a prioritisation queue than an exposed asset that can be reached quickly with commodity methods.
What Feasibility Changes In Threat Analysis
Feasibility helps translate raw threat data into decision-making. Two assets with the same weakness can have very different exposure if one is internet-facing, tightly governed, and heavily monitored, while the other is isolated, short-lived, or requires a highly capable actor to reach it. That is why feasibility is often paired with impact, rather than used alone.
In practical threat analysis, feasibility also separates opportunistic abuse from targeted campaigns. A function may be easy to exploit in general but hard to weaponise against a specific environment because of segmentation, strong authentication, limited reach, or the absence of the prerequisites an attacker needs. The ISO/SAE 21434 Automotive Cybersecurity Engineering Guide uses attack feasibility thinking in a structured way, which is useful wherever teams need to compare likelihood across different attack paths.
How Teams Judge Exposure And Prioritise Controls
Feasibility is usually assessed by combining asset inventory, attack surface, trust relationships, and the defender’s own control environment. Internet exposure, third-party dependencies, administrative reach, credential availability, and weak segmentation all raise feasibility because they reduce the work an attacker must do before a successful compromise becomes realistic.
That makes feasibility especially important for prioritising controls and tests. A high-impact weakness with very low feasibility may justify observation and hardening, while a medium-impact weakness with high feasibility may demand immediate remediation. Threat modelling works best when the team asks not only what could be attacked, but how much attacker effort is really required to make that attack succeed.
Why Feasibility Matters After A Successful Attack
When a specific attack becomes feasible, the downstream consequences depend on what the attacker can reach once they are in. That may include credentials, trusted sessions, privileged functions, data stores, signing material, or operational workflows that were not intended to be exposed. Feasibility is therefore a pre-compromise concept with post-compromise consequences.
For that reason, feasibility should be revisited as environments change. New integrations, newly exposed services, weaker approvals, or added automation can shift an asset from “unlikely target” to “practical target” without the underlying vulnerability changing at all. The Anthropic report on the first AI-orchestrated cyber espionage campaign is a reminder that attacker capability can change quickly, which can make previously marginal paths materially more feasible.
Risk and Threat Considerations
Targeted attack feasibility matters because it describes the point where a weakness becomes operationally exploitable for a specific adversary, not merely possible in theory. If feasibility is underestimated, organisations can prioritise the wrong fixes and leave a reachable path open long enough for an attacker to take advantage of it.
Failure mechanism: An attacker succeeds when the target’s exposure, trust relationships, or control gaps reduce the effort needed to a level the attacker can realistically sustain.
Impact: The likely result is a more credible attack path, faster compromise, and a stronger case for urgent remediation, compensating controls, or targeted monitoring.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | RA-3 — Risk Assessment | Targeted attack feasibility is a risk-assessment judgement about exploitability and likelihood. |
| RA-5 — Vulnerability Monitoring and Scanning | Feasibility depends on current exposure, reachability and known weaknesses that scanning can reveal. | |
| Recommendation — Assess exploitability and likelihood to prioritise remediation for the most feasible attack paths. Continuously scan and monitor assets to identify weaknesses that raise attack feasibility. | ||
| MITRE ATT&CK | Enterprise Matrix | Threat feasibility is shaped by attacker tactics, techniques and the paths they can realistically use. |
| Recommendation — Map feasible attack paths to ATT&CK techniques and hunt for the enabling conditions. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset vulnerabilities are identified and documented | Feasibility depends on knowing which exposed weaknesses and assets are actually in play. |
| GV.RM-01 — Risk Management Strategy | Feasibility supports prioritisation decisions within a broader risk management strategy. | |
| Recommendation — Document exposed vulnerabilities and rank them by how feasible they are to exploit. Use feasibility assessments to rank remediation effort against business impact and threat realism. | ||
Practitioner Guidance
What to watch for: Treat feasibility as a moving judgement, not a fixed label. Changes in exposure, identity pathways, external dependencies, or attacker tooling can materially alter how likely a targeted compromise is, even when the underlying asset has not changed.
Governance implication: Use feasibility to defend prioritisation decisions, especially when multiple risks compete for remediation time. A clear feasibility judgement helps justify why one issue is acted on now while another is tracked and reviewed later.
Related resources from NHI Mgmt Group
- Why do targeted attacks increase risk for organizations with exposed cloud, mobile, and AI attack surfaces?
- What happens when a recruiter visits a fake resume site in a targeted job-themed attack?
- What is the difference between a targeted attack and an untargeted attack?
- What are the signs that a user is not ready to respond appropriately to a targeted attack?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org