Keywords: Quantum communication, Quantum key distribution, QKD, Cybersecurity, Risk assessment, MITRE ATT&CK, Kill chain, Photon-number splitting attack, SQOUT, Threat modelling

1 Introduction↩︎

Quantum Key Distribution (QKD) offers information-theoretically secure key exchange, with eavesdropping attempts detectable through quantum measurement disturbance. However, practical QKD implementations introduce vulnerabilities across physical infrastructure, protocols, and classical subsystems—attack surfaces that existing threat models do not address.

With quantum communication moving from experimental prototypes to operational deployments, driven by initiatives such as the European Quantum Communication Infrastructure (EuroQCI) [1], understanding and managing their security risks becomes a practical necessity. Classical cybersecurity frameworks such as MITRE ATT&CK [2], the Lockheed Martin Cyber Kill Chain [3], and NIST SP 800-30 [4] have proved effective for characterising adversarial behaviour in IT environments. We adopt MITRE ATT&CK as the structural basis because its technique-level granularity and continuous community updates make it directly actionable for detection and mitigation. The taxonomy introduced here adapts the ATT&CK conceptual structure to quantum communication systems rather than replicating it.

1.1 Overview of Related Work↩︎

Prior works have characterised individual quantum attack vectors: detector-blinding attacks [5], Trojan-horse exploits [6], CV-QKD side channels [7], broader side-channel surveys [8], and device-independent QKD security proofs [9]. These studies analyse specific vulnerabilities but do not model the full end-to-end adversary path. QKD-focused risk assessments such as [10], security analyses of QKD with realistic devices [11], and surveys of quantum risk trends [12] categorise threats and identify empirical risk patterns, yet they analyse individual attack surfaces rather than chaining reconnaissance, access, and exploitation into a single assessable scenario. Classical risk frameworks (NIST SP 800-30 [4], ISO/IEC 27005 [13]) provide mature scoring methods but do not address quantum-specific attack mechanics. Our framework bridges this gap by building full kill chains that link quantum and classical techniques, scored using ISO/IEC 27005-compatible aggregation.

1.2 Novelty of the current work↩︎

The novelty of the current work as well as its main contributions are as follows:

• A kill-chain-based threat model that combines quantum and classical TTPs into end-to-end attack sequences, moving beyond isolated vulnerability catalogues.

• A quantitative risk scoring methodology using attack-tree product aggregation of technique-level likelihoods, aligned with ISO/IEC 27005 and compatible with standard risk matrices.

• SQOUT, a threat-intelligence platform that integrates the taxonomy, scoring, and interactive kill-chain analysis into a single operational tool.

1.3 Paper Outline↩︎

This paper introduces a structured framework for analysing threats to quantum communication systems by combining a taxonomy of attacks, kill-chain modelling, and quantitative risk evaluation. In section 2 we introduce the motivation for structured risk assessment in quantum communication deployments and discuss why classical cybersecurity frameworks must be adapted to account for quantum-specific vulnerabilities. Section 3 follows with a taxonomy of attacks on quantum communication systems. The taxonomy classifies attacks according to objectives, mechanisms, deployment environments, and adversary characteristics, and establishes the conceptual vocabulary used throughout the remainder of the paper. Then in section 4, we introduce SQOUT², our threat-intelligence platform that operationalises the taxonomy. The platform provides a structured repository of quantum-specific Tactics, Techniques, and Procedures (TTPs) and enables the construction of adversarial kill chains that combine classical and quantum attack techniques. Section 5 builds on the kill-chain representation to perform quantitative risk assessment. Using an ISO/IEC 27005-aligned methodology, technique-level likelihood scores are aggregated into scenario-level risk ratings. Two case studies, Photon-Number Splitting (PNS) and detector-blinding attacks, illustrate the methodology. Finally, in 6 we summarise the main findings and discuss future extensions of the framework, including conditional modelling of attack dependencies and integration with emerging quantum threat-intelligence sources.

2 Risk and Threat Assessment↩︎

QKD is often described as providing a theoretically unbreakable key-exchange mechanism for secure communication purposes. Efforts are ongoing to adopt it for high-security applications (e.g., critical infrastructure and classified governmental networks). Initiatives such as the EuroQCI aim to secure communications with QKD up to EU Secret level [14]. Similar programs in Asia, North America, and the private sector [15], [16] underline the strategic importance of QKD for finance, energy, and defence, but also amplify the need for rigorous risk analyses, especially in the implementation and use of QKD systems.

Several National Security Agencies (NSAs) have warned of practical QKD vulnerabilities [8], [17]. The U.S. NSA highlights denial-of-service risks (via induced eavesdropping alarms), hardware flaws exploited in lab attacks, and insider threats from trusted relays [18]. European bodies (BSI, ANSSI, AIVD, etc.) similarly note the immature security maturity of QKD, high infrastructure costs and niche applicability, recommending parallel investment in post-quantum cryptography (PQC) [17] for a more scalable defence.

To systematically analyse these risks, a structured description of possible attacks is required. The following section introduces a taxonomy of attacks on quantum communication systems that provides the foundation for the threat model used in SQOUT.

3 Taxonomy of Attacks on Quantum Communication Systems↩︎

A risk and threat assessment for quantum communications must cover:

• Physical infrastructure: Fibre, satellite, and device risks (tampering, loss, environment).

• Protocol threats: Quantum-specific attacks (photon-number splitting, Trojan horse, side channels).

• Classical interdependence: Weak links in hybrid quantum-classical deployments.

• Operational factors: Human error, supply chain flaws, and insider risk.

A key novelty of our work is that, beyond cataloguing individual quantum and classical techniques, we organise them into sequential kill-chain phases. A kill chain (sometimes also called a risk scenario) represents an ordered sequence of adversarial techniques that must succeed for an attack scenario to be realised. This end-to-end view captures inter-step dependencies and enables holistic risk scoring.

This section defines and categorises attacks on quantum communication systems, focusing on their objectives, mechanisms, and contexts. By aligning with classical Tactics, Techniques, and Procedures (TTPs) frameworks, we aim to make quantum-specific threats accessible and actionable for security professionals.

3.1 Defining Attacks↩︎

We categorise attacks by their objectives (1), reflecting the adversary’s intent and the potential impact on the system:

• Destruction: Permanent and non-reversible compromise of quantum communication systems until repaired or replaced. Destruction can be categorised into two types:

  • Physical Destruction: Direct physical damage to infrastructure or components, such as cutting optical fibres, burning out single-photon detectors, tampering with cryogenic equipment, or damaging optical hardware.

  • Logical/Software Destruction: Permanent corruption or deletion of critical control, calibration, or key management software, rendering the system inoperable even though the hardware remains intact.

  Both forms result in long-term loss of service and require repair or replacement to restore operation.

• Denial of Service (DoS): Temporary and reversible disruption of quantum communication functionality by preventing legitimate use of system resources or communication channels. Examples include jamming free-space optical links, saturating detectors, or overloading quantum channels to impede key generation or transmission. Unlike destruction, DoS attacks cease to have effect once the interference or resource exhaustion stops.

• Quantum Key or Data Extraction: Involving attempts to intercept encryption keys generated via QKD or extract sensitive quantum data (of quantum communication services beyond QKD, e.g., blind quantum computing). This category includes attacks aiming for full key/data extraction, where the entire quantum key or dataset is compromised, and partial key/data extraction, where only fragments are obtained but could still pose significant security risks. Examples of these quantum-specific attacks include photon-number-splitting (PNS) [19] or Trojan-horse attacks [20].

• Reducing Security: Attacks involve introducing weaknesses to compromise a system or reduce the security parameter below the threshold guaranteed by its quantum security proof. Examples include laser damage attacks on the watchdog or attenuator [21], or laser seeding attacks [22].

3.2 Attack Mechanism↩︎

In addition to defining attack objectives, we classify attacks according to their dominant mechanisms and operational domains, acknowledging that most practical threats to QKD systems span both quantum and classical layers:

• Quantum-Dominant Attacks: Attacks primarily exploiting imperfections in quantum state preparation, transmission, or measurement processes. These rely on manipulating quantum phenomena—such as photon statistics, detector timing, or entanglement correlations—although classical information exchange (e.g., sifting data) may still be required to complete the exploit. Examples include photon-number-splitting and time-shift attacks.

• Classical-Dominant Attacks: Attacks that mainly target the classical subsystems supporting QKD operation, such as control software, synchronization, authentication, or key management. Examples include injecting false timing signals, tampering with error-correction routines, or compromising authentication mechanisms.

• Cross-Layer (Hybrid) Attacks: Coordinated, multi-domain exploits that deliberately combine quantum and classical manipulations to achieve outcomes unattainable by either layer alone. For instance, compromising calibration software to induce detector mismatches subsequently exploited by a faked-state quantum attack [23], or altering authentication routines to enable a man-in-the-middle quantum intercept-resend.

We also classify attacks by their deployment environment:

• Fibre-Based Attacks: These target vulnerabilities in the optical fibre infrastructure, such as tapping, bending-induced signal leakage, or physical intercept or sabotage. For example, a naive intercept-and-resend attack is relatively straightforward to perform on fibre, as the medium offers stable and controlled transmission conditions.

• Free-Space Attacks: These focus on free-space communication channels, such as satellite links or ground-to-satellite connections. While similar attack concepts may apply, free-space environments present unique challenges, such as atmospheric interference and line-of-sight constraints, making even basic attacks, like intercept-and-resend, more complex.

The differences in attack feasibility between fibre and free-space deployments require environment-specific security measures.

3.3 Additional Classifications↩︎

In addition to objectives, mechanisms, and environments, we further distinguish attacks along several key dimensions:

Adversary Capabilities: from low-capability opportunists with basic tools (e.g., simple fibre taps) to nation-state actors with advanced quantum hardware and deep R&D backing.

Attack Phase: spanning the supply-chain (hardware trojans, firmware tampering), deployment (intercepting shipments, misconfiguration), operational (intercept-and-resend, side-channel exploits), and decommissioning (recovering residual quantum data) stages.

Target System Layers: from the physical layer (optical-fibre tapping, free-space jamming) through the protocol layer (man-in-the-middle, information-reconciliation side channels) to the application layer (compromising quantum-secured services or post-quantum transitions).

3.4 Tactics↩︎

Building on MITRE ATT&CK and D3FEND [24], we define offensive and defensive tactics tailored to quantum communications. The meaning of each tactic remains unchanged; it is simply applied in the quantum context to guide security practitioners.

Certain techniques, e.g., PNS, span multiple tactics (execution, collection, exfiltration). Rather than force one category, we assign them to all relevant tactics, maintaining a flexible, comprehensive threat model.

4 SQOUT↩︎

Building on the attack taxonomy defined in 3, we introduce SQOUT, QuDef’s [25] threat-intelligence platform that organises quantum attack techniques into a structured, queryable knowledge base. It covers quantum communication, computing, and sensing, and follows the MITRE ATT&CK organisational model. The platform maintains a hierarchical repository of adversarial techniques and defensive countermeasures, mapped to quantum protocols, detection methods, hardware elements, software modules, and threat actors.

SQOUT provides a matrix of TTPs covering quantum-specific compromise scenarios. For each technique, it records descriptions, indicators of compromise, and countermeasures.

In its current form, SQOUT is a prototype demonstrating the feasibility of structured quantum threat intelligence. It has not undergone formal certification and remains under active development, while already supporting a number of security analyses.

Beyond its static knowledge base, SQOUT includes a suite of interactive applications that support the end-to-end threat-modelling lifecycle. Users can graphically build a quantum system architecture, annotate it with relevant TTPs, and execute automated risk assessments or analyses. These tools support identification of high-impact vulnerabilities and validation of proposed defences.

4.1 Kill Chain Example↩︎

As an example, the PNS [19] attack kill chain illustrates the step-by-step progression of a threat actor targeting a quantum communication system, divided into four phases: Knowing, Entering, Finding, and Exploiting, as visualised in 2.

Knowing: The initial phase focuses on gathering critical information about the quantum communication system. Threat actors collect details about the quantum communication module (protocols, sources, properties) and the supporting quantum and classical channels, including their locations. Concurrently, they develop specialised quantum attack capabilities, such as a PNS attack apparatus requiring non-demolition measurement and quantum memory, along with the cyber tools necessary to extract information from classical links.

Entering: In this phase, the adversary begins compromising system components to gain entry. This includes eavesdropping on the classical channel used in the quantum communication system and physically accessing the fibre optic cable carrying the quantum link. These steps enable the attacker to position themselves for active engagement with the quantum communication.

Finding: The attacker executes the PNS attack itself, exploiting vulnerabilities in multi-photon pulses to extract quantum key information. This step represents the core malicious activity and requires precise quantum attack tools and expertise.

Exploiting: In the final phase, the adversary processes the intercepted quantum data to extract a key identical to that of the legitimate communication parties. They then utilise or abuse the acquired key, potentially leading to unauthorised access or further exploitation of the system.

This example illustrates how TTPs from the SQOUT catalogue compose into a complete kill chain that can be scored using the risk methodology in the next section.

Quantitative risk assessment of these kill chains requires a scoring methodology, which the following section introduces.

5 Methodology: Risk Analysis and Evaluation↩︎

This section presents the methodological core of the paper: a reproducible procedure for converting a kill chain into an ISO/IEC 27005-compliant risk rating. The methodology is fully specified by (i) the technique-level scoring rules of 5.2, (ii) the aggregation operators and discretisation bounds defined in the same subsection, and (iii) the global modifier and matrix lookup of 5.3. The two worked case studies in 5.5 and 5.6 act as demonstrated proofs of use, executing every methodological step end to end on two independent attack scenarios with materially different resource profiles.

We now apply this ISO/IEC 27005-compliant risk assessment [13] to the kill-chain structures and SQOUT technique inventory introduced above. ISO/IEC 27005 structures risk management into (a) context establishment, (b) risk analysis (likelihood and impact estimation), and (c) risk evaluation (matrix lookup), followed by treatment and review. Our model retains likelihood estimates at the technique level and aggregates them into a single risk rating per scenario.

5.1 Context Establishment↩︎

Prior to numeric scoring, the organisation must define the following properties:

• Scope: the boundaries of the quantum‐communication system under review (e.g., the free-space QKD link, its repeater nodes, and classical control channels).

• Risk acceptance criteria: the thresholds in the 5×5 matrix that delineate Acceptable, Tolerable, and Unacceptable risk.

• Roles and responsibilities: assignment of who conducts analysis, who reviews and signs off residual risk, and who implements countermeasures.

These elements ensure that subsequent likelihood and impact estimates are judged against pre‐agreed organisational objectives and compliance requirements.

5.2 Risk Analysis↩︎

In this model, a kill chain refers to a sequence of adversarial steps (techniques) required to execute a complete attack, from reconnaissance through exploitation. A risk scenario is defined as the successful completion of a specific kill chain under a given set of system conditions and controls. Risk is evaluated at the scenario level, with likelihood derived from the individual steps and impact representing the consequence of full scenario success.

The risk analysis produces two separate ordinal values on a scale of 1 to 5 for each risk scenario (a complete kill chain, such as a PNS attack on a QKD link using a weak coherent pulse source without decoy-state protection): \[\text{Likelihood }L\in\{1,\dots,5\}, \quad \text{Impact }I\in\{1,\dots,5\}.\]

5.2.1 Likelihood Estimation↩︎

Likelihood reflects the probability that an adversary successfully executes a complete attack scenario (i.e., the entire kill chain) given the existing system controls. In the proposed model, likelihood is first estimated at the technique level. Each technique \(i\) in the kill chain is assigned two base scores: a Threat score \(T_i\) that reflects the capability class of adversary that would attempt and succeed at the technique, and an Exposure score \(E_i\) that represents the target system component’s combined accessibility and vulnerability to that technique.

These scores are combined to produce an intermediate likelihood contribution for each technique. The individual contributions are subsequently aggregated across the kill chain to estimate the scenario-level likelihood of a successful attack.

The impact \(I\) of the attack is assessed separately at the scenario level and reflects the consequences if the entire kill chain succeeds.

5.2.1.1 Technique-level Scoring.

For each step \(i\) in the kill chain (as enumerated in 4.1), assign (reference scales and modifier examples are given in 4 and 5) \[T_i,\;E_i\;\in\{1,2,..,n_{max}\}, \qquad m_i\in(0,\mu_{\max}\rangle\] where \(T_i\) is the threat score (adversary capability class), \(E_i\) the exposure score (combined accessibility and vulnerability), and we use \(n_{max}=5\). The parameter \(m_i\) is a technique‐specific multiplier (e.g., extra countermeasure or environmental hindrance) which is bounded by \(\mu_{\max}=2\) to ensure that contextual modifiers adjust the base likelihood without dominating it. This helps to preserve the interpretability of the base Threat and Exposure scores while still allowing moderate amplification or reduction due to environmental factors or countermeasures. Define the step’s raw likelihood contribution: \[\label{eq:step95likelihood} \ell_i = (T_i\times E_i)\times m_i.\tag{1}\] The resulting value \(\ell_i\) is not yet a probability but a relative likelihood score used for subsequent aggregation.

5.2.1.2 Aggregation to Scenario Raw Likelihood.

The individual step contributions \(\{\ell_i\}\) must be combined into a single continuous measure \(L_{\rm raw}\) that reflects the ease with which an adversary can complete the entire kill chain. Let \(N\) be the total number of steps (techniques) in that kill chain. Three common aggregation strategies are:

• Maximum: \(L_{\rm raw}=\max_i \ell_i\). This approach assumes that the easiest step for the attacker dominates the scenario likelihood. It highlights the single weakest link in the chain and is conservative when any one step could enable full compromise.

• Average: \(L_{\rm raw}=\frac{1}{N}\sum_i \ell_i\). By computing the mean of all step contributions, this method treats each phase as equally important. It smooths out extreme values and is appropriate when partial difficulty in one step can be offset by ease in another. Note, however, that the average can overestimate feasibility for chains containing one near-infeasible step, because it does not reflect the AND-logic of sequential attack success.

• Probabilistic (attack-tree product): First, convert each step’s likelihood into a success probability: \[p_i \;=\;\min\!\Bigl(1,\;\frac{\ell_i}{T_{\max}\cdot E_{\max}}\Bigr) = \min\!\Bigl(1,\;\frac{\ell_i}{25}\Bigr),\]

  where \(T_{\max}\) and \(E_{\max}\) denote the maximum values of the Threat and Exposure scales. The denominator \(T_{\max}\cdot E_{\max}\) represents the maximum possible base score (before the technique multiplier \(m_i\)). When \(m_i > 1\), the raw product \(\ell_i = T_i \cdot E_i \cdot m_i\) can exceed \(T_{\max}\cdot E_{\max}\). Values exceeding this bound are intentionally clamped to via \(\min(1,\cdot)\), reflecting that favourable conditions make the step almost certain once the attack is attempted.

  Assuming conditional independence of step success probabilities (see the “Independence Assumptions” paragraph below for discussion and limitations), the chain success probability is the product over all steps (AND-node in attack-tree terminology): \[P_{\rm chain} \;=\;\prod_{i=1}^N p_i.\] \(P_{\rm chain}\) is the compound probability that the attacker succeeds at every step — the standard aggregation for a serial attack chain in attack-tree analysis [26], Bayesian attack graphs [27], [28], and network vulnerability analysis [29].

  Unlike the maximum and average methods, the attack-tree product does not produce a score-valued \(L_{\rm raw}\); its output is a probability. The global multiplier \(M\) is therefore applied in log-space via exponentiation, which is the natural analogue of linear scaling on a logarithmic axis: \[P_{\rm adj} \;=\; P_{\rm chain}^{\,1/M}.\] Since \(\log_{10} P_{\rm adj} = \log_{10} P_{\rm chain}\,/\,M\), a higher \(M\) (more threatening environment) compresses the negative log-probability, increasing the adjusted probability, while a lower \(M\) (hardened environment) stretches it, reducing the adjusted probability. For \(M=1\) the adjustment is neutral. \(P_{\rm adj}\) is then discretised via the logarithmic bins in 2.

1 summarises how to select the aggregation method based on system criticality, risk appetite, and compliance considerations.

5.2.1.3 Theoretical Rationale for the Attack-Tree Product.

In the attack-tree analysis [26], a kill chain corresponds to an AND-decomposition: the attacker must succeed at every step for the full chain to succeed. Under the standard independence assumption, the compound success probability is the product of step probabilities. This is the same aggregation used in Bayesian attack graphs, where AND-nodes compute \(P(\text{goal})=\prod p_i\) [27]–[29], and in series-system reliability models, where overall system success probability equals the product of component success probabilities [30]. Because multi-step chain probabilities span many orders of magnitude, the attack-tree product requires logarithmic discretisation (defined in the paragraph Logarithmic Aggregation of Attack-Tree Probabilities below) to enable meaningful discrimination between chains of different feasibility.

5.2.1.4 Ordinal Scales and Arithmetic Operations.

The Threat and Exposure scores are ordinal, meaning that the intervals between adjacent values (e.g., \(T=2\) vs.\(T=3\)) are not guaranteed to be equal in a strict measurement-theoretic sense. Performing arithmetic operations such as multiplication and product-based aggregation on ordinal data is, strictly speaking, an approximation. However, this practice is standard in widely adopted risk frameworks, including ISO/IEC 27005 [13] and FAIR [31], where ordinal likelihood and impact scales are routinely multiplied to produce risk ratings. The final discretisation step (defined in the paragraph Global Adjustment and Discretisation below) maps the continuous intermediate result back to an ordinal category (\(L \in \{1,\dots,5\}\)), so the output remains on the same ordinal scale as the inputs. The intermediate arithmetic is therefore a modelling convenience that enables structured aggregation across kill-chain steps, not a claim of interval-scale precision. Subjectivity in the assignment of \(T\) and \(E\) values is inherent to any expert-driven risk framework; consistency is ensured by using the reference definitions in 4 and applying them uniformly across all scenarios.

5.2.1.5 Independence Assumptions.

The attack-tree product aggregation assumes that kill-chain steps succeed independently. In practice, steps are often positively correlated, for example, physical access to a fibre link may enable both classical eavesdropping and quantum-channel interception. Under positive correlation, the true compound probability of full-chain success is higher than the product of marginal probabilities. Consequently, the independence assumption yields a lower bound on scenario likelihood, making the attack-tree product estimate conservative rather than optimistic. Extending the model to conditional probabilities (e.g., via a Bayesian network where each node’s success probability depends on its predecessors) is straightforward within the framework and is planned as future work. It is worth noting that similar independence assumptions are standard at the base level of established risk frameworks, including NIST SP 800-30 [4] and classical kill-chain models, where step-level likelihoods are typically assessed and combined without explicit conditional modelling.

5.2.1.6 Global Adjustment and Discretisation.

Apply an environment-level multiplier \(M \in (0,2\rangle\) which globally adjusts likelihoods to reflect the overall threat context in which the kill chains are assessed. For example, a higher \(M\) (e.g., 1.5) may represent a highly capable, state-sponsored adversary or a critical national infrastructure deployment, while a lower \(M\) (e.g., 0.7) could reflect strong system hardening or low adversary motivation.

For the maximum and average aggregation methods, \(M\) scales the raw score linearly: \[L_{\rm adj}=L_{\rm raw}\times M.\] For the attack-tree product, \(M\) acts in log-space via \(P_{\rm adj} = P_{\rm chain}^{1/M}\) (see above), ensuring that the global multiplier has proportional impact on the logarithmic discretisation scale. Because the product method operates on a logarithmic scale while the max and average methods operate on a linear scale, the same \(M\) value produces different absolute magnitudes of adjustment: for example, \(M=1.5\) shifts \(P_{\rm adj}\) by roughly one logarithmic bin width (\({\sim}2\) orders of magnitude), which corresponds to approximately one ordinal level—comparable to the \({\sim}1\)-level shift produced by linear scaling of the max or average raw scores.

The discretisation bounds are fixed to the base score range, independent of the scenario set: \[L_{\min}=0,\qquad L_{\max}=T_{\max}\cdot E_{\max}=n_{\max}^2.\] For our 1–5 scales, \(L_{\max}=25\). Divide \([L_{\min},\,L_{\max}]\) into five equal intervals and assign the ordinal likelihood \[L=1+\left\lfloor 5\,\frac{L_{\rm adj}-L_{\min}}{L_{\max}-L_{\min}}\right\rfloor,\] clamped to \(\{1,\dots,5\}\).

The discretisation bounds \(L_{\min}=0\), \(L_{\max}=T_{\max}\cdot E_{\max}\) are consistent with the attack-tree product normalisation, which uses the same denominator \(T_{\max}\cdot E_{\max}\) to convert step scores to probabilities. Each bin therefore corresponds to a 20% step-probability range: \(L=1\) maps to \(p<0.2\) (hard step), \(L=5\) to \(p\ge0.8\) (near-certain step). Because the bounds derive from the scale definition alone, they are deterministic: adding or removing scenarios from the evaluation set never changes existing discretised values.

5.2.1.7 Effect of Modifiers on the Discretisation Bounds.

Technique modifiers \(m_i \neq 1\) and the global multiplier \(M \neq 1\) shift intermediate values outside the base score range \([0,\;T_{\max}\cdot E_{\max}]\). The framework handles both directions consistently across all three aggregation methods.

Amplification (\(m_i > 1\) or \(M > 1\)). When modifiers push values above the base maximum \(T_{\max}\cdot E_{\max}\):

• Attack-tree product: \(p_i = \min(1,\;\ell_i / (T_{\max}\cdot E_{\max}))\) clamps to \(p_i = 1\), treating the step as certain to succeed. The remaining steps still contribute their probabilities to the chain product.

• Maximum and average: The discretisation formula may yield a value above \(5\), which is clamped to \(L=5\).

The amplifying modifier still has an effect when the unadjusted score is below the base maximum — for example, \(\ell_i = 3\times4\times1.2 = 14.4\) (below 25, no clamping) versus \(\ell_i = 5\times5\times1.2 = 30\) (above 25, clamped to \(p_i=1\) or \(L=5\)). If many steps in a kill chain are amplified to the ceiling, the base \(T\) and \(E\) scores should be re-examined rather than relying on large modifiers.

Mitigation (\(m_i < 1\) or \(M < 1\)). When modifiers reduce values toward the bottom of the scale:

• Attack-tree product: A mitigated step receives a lower \(p_i\), which directly reduces the chain product \(P_{\rm chain}\). For example, applying \(m_i=0.2\) to a step with \(T_i=4\), \(E_i=4\) yields \(\ell_i = 3.2\) and \(p_i = 0.128\), compared to \(p_i = 0.64\) without the modifier — a \(5\times\) reduction in the step’s success probability. A global modifier \(M < 1\) acts via \(P_{\rm adj} = P_{\rm chain}^{1/M}\); since \(1/M > 1\) and \(P_{\rm chain} < 1\), the adjusted probability \(P_{\rm adj} < P_{\rm chain}\), correctly reducing the scenario likelihood.

• Maximum and average: \(L_{\rm adj} = L_{\rm raw}\times M\) decreases proportionally. The discretisation formula naturally maps small values to \(L=1\). No lower clamping beyond \(L=1\) is needed, since \(L_{\min}=0\) and \(L_{\rm adj}\) remains non-negative.

Note that mitigation modifiers are not symmetric to amplification in their impact on the ordinal scale: \(m_i = 0.2\) can reduce a step’s contribution by \(5\times\), while \(m_i = \mu_{\max} = 2\) can at most double it (before clamping). This asymmetry is intentional (see 5.4): a targeted countermeasure can near-eliminate a specific step, whereas aggravating factors are bounded more tightly because the baseline \(T\) and \(E\) scores already capture the primary attack feasibility.

5.2.1.8 Logarithmic Aggregation of Attack-Tree Probabilities.

For the attack-tree product, the adjusted probability \(P_{\rm adj}\) spans many orders of magnitude, making linear binning unsuitable. We discretise on a logarithmic scale, assigning ordinal likelihood levels based on order-of-magnitude bands.

The bin boundaries are defined as absolute success-probability thresholds, analogous to the frequency bands used in probabilistic risk assessment (e.g., core-damage frequency bands in NUREG-1150 [32] and likelihood categories in the NASA PRA Procedures Guide [33]). To calibrate the boundaries, consider the theoretical range of \(P_{\rm adj}\) for an \(N\)-step chain with step probabilities \(p_i \in [p_{\min},\;1]\), where \(p_{\min} = \ell_{\min}/(T_{\max} \cdot E_{\max})\). The log-scale range is \([\,N\log_{10} p_{\min}/M,\;0\,]\). For the kill chains in this paper (\(N=9\), \(M=1\)), taking the smallest modifier value \(m_i=0.2\) with the minimum base scores \(T_i=E_i=1\) gives \(\ell_{\min}=1\times1\times0.2=0.2\) and thus \(p_{\min}=0.2/25=0.008\), yielding a log-scale range of approximately \([-19,\;0]\). We select five bins of equal width \(\Delta = 2\) orders of magnitude, anchored so that the upper boundary (\(\log_{10} P = 0\), i.e.\(P=1\)) corresponds to \(L=5\):

The four resolved bins (\(L=2\)–\(5\)) cover eight orders of magnitude; scenarios with \(P_{\rm adj} < 10^{-8}\) are collected into the \(L=1\) overflow bin. Because the bins represent absolute success probabilities, they are chain-length-independent: a longer chain with more steps naturally produces a lower \(P_{\rm adj}\), correctly reflecting the greater compound difficulty. For assessments involving substantially shorter or longer chains (e.g., \(N \le 4\) or \(N \ge 15\)), the bin width \(\Delta\) or the number of resolved bins may be adjusted to match the effective dynamic range, following the same anchoring principle.

The maximum and average aggregation methods produce values on a linear scale and continue to use the linear discretisation above. The attack-tree product produces values on a multiplicative (logarithmic) scale and therefore requires logarithmic binning. Each discretisation is matched to the mathematical nature of its aggregation method.

5.2.2 Impact Estimation↩︎

Impact \(I\) represents the severity of the consequence if the entire kill-chain scenario succeeds. Following ISO/IEC 27005, impact is assessed as a single ordinal value \(I \in \{1,\dots,5\}\), ranging from very low (\(I=1\), negligible operational effect) through medium (\(I=3\), significant service degradation) to very high (\(I=5\), catastrophic compromise of mission-critical assets). In practice, one chooses \(I\) based on the worst-case effect of the scenario (e.g., potential data loss, service outage, or national security implications) without indexing by step. For example, if a PNS attack on a QKD link would expose mission-critical keys, one might assign \(I=5\).

5.3 Risk Evaluation↩︎

With Likelihood \(L\) and Impact \(I\) on matching 1-5 scales, the final risk rating \(R = L \times I\in\{1,\dots,25\}\) is obtained from the standard ISO/IEC 27005 matrix: \[R = \mathrm{Matrix}[L,I].\]

The risk categories in 3 are defined by the following boundaries: Low (\(R \in \{1,2,3\}\)), Medium (\(R \in \{4,5,6,8,9,10,12\}\)), and High (\(R \in \{15,16,20,25\}\)). Organisations then compare \(R\) to their risk‐acceptance criteria (e.g., treat all \(R\ge 15\) as High) and plan mitigation accordingly.

5.4 Base Likelihood Scoring and Multiplicative Modifiers↩︎

Each attack technique \(i\) is assigned base scores \(T_i\) and \(E_i\) denoting, respectively, the adversary capability class required to attempt and succeed at the technique, and the target component’s combined accessibility and vulnerability, both assessed for a environment (moderate controls, average adversary). Higher \(T\) increases likelihood because a more capable adversary—the kind that would attempt a high-\(T\) technique—is also more likely to succeed. 4 provides reference definitions.

To reflect contextual factors – such as enhanced countermeasures, environmental conditions, or elevated adversary capability – these base scores are combined multiplicatively with a strictly positive, technique‐specific multiplier \(m_i\). A global multiplier \(M\) may then be applied at the scenario level to adjust for overarching threat contexts (e.g., critical infrastructure deployment or state-sponsored actors).

The specific numerical values chosen for \(m_i\) and \(M\) are at the discretion of the risk engineers conducting the analysis. They must be justified based on threat intelligence, system characteristics, or empirical data, and used consistently across all scenarios being compared to ensure coherent and defensible results.

As a calibration guide, the following ranges are suggested:

• \([0.1,\,0.3]\) – the condition nearly eliminates the step or scenario (e.g., the required technology does not exist, or a provably secure countermeasure is deployed);

• \((0.3,\,0.6]\) – a strong but not absolute mitigation is in place (e.g., dedicated hardware defence that can, in principle, be circumvented);

• \((0.6,\,1.0)\) – a moderate environmental or operational hindrance (e.g., adverse weather for free-space links);

• \(1.0\) – neutral baseline (no adjustment);

• \((1.0,\,1.5]\) – a condition that moderately amplifies the step or scenario (e.g., combining multiple side-channel vectors);

• \((1.5,\,\mu_{\max}]\) – a condition that strongly amplifies feasibility (e.g., state-level resources and motivation).

The range is intentionally asymmetric: targeted countermeasures can near-eliminate specific steps (e.g., decoy-state deployment against PNS, \(m_i=0.3\)), whereas aggravating factors represent incremental departures from the baseline already captured in the \(T\) and \(E\) scores and are therefore bounded more tightly.

Examples of both technique-level and global modifiers, with rationale for the chosen values, are shown in 5.

5.5 Example: Photon-Number Splitting (PNS) Attack Kill Chain (ISO-aligned)↩︎

We illustrate the likelihood-only technique-level scoring with multiplicative modifiers, followed by scenario-level impact and 5\(\times\)​5 matrix evaluation.

5.5.0.1 Step scores.

For each step we assign base Threat \(T_i\) and Exposure \(E_i\) (4), a technique modifier \(m_i\) (5), and compute \(\ell_i\).

5.5.0.2 Aggregate likelihood.

Using the nine step-likelihood contributions \(\{\ell_i\}\) from 6, we obtain three continuous measures \(L_{\rm raw}\):

\[\ell = \{2.0,\;4.0,\;3.2,\;4.0,\;7.2,\;6.4,\;4.8,\;6.0,\;6.0\}.\]

1. Maximum: \[L_{\rm raw}^{\max} =\max_i \ell_i =7.2.\]

2. Average: \[L_{\rm raw}^{\rm avg} =\frac{1}{9}\sum_{i=1}^{9}\ell_i =\frac{43.6}{9}\approx4.84.\]

3. Probabilistic (attack-tree product): First convert each \(\ell_i\) into a success probability \[p_i = \min\!\Bigl(1,\frac{\ell_i}{25}\Bigr) =\{0.08,\;0.16,\;0.128,\;0.16,\;0.288,\;0.256,\;0.192,\;0.24,\;0.24\}.\] Then \[P_{\rm chain} = \prod_{i=1}^{9} p_i \approx 2.14\times10^{-7}.\] With \(M=1\), \(P_{\rm adj}=P_{\rm chain}^{1/1}=P_{\rm chain}\). Using the logarithmic discretisation (2), \(\log_{10}(P_{\rm adj})\approx -6.67\), which falls in the \((-8,\;-6]\) bin, giving \(L^{\rm prod}=2\).

Here and below, the superscripts \(\max\), \(\rm avg\), and \(\rm prod\) denote the discretised likelihood obtained via the maximum, average, and attack-tree product aggregation methods, respectively.

5.5.0.3 Impact and risk rating.

In this example, the scenario-level impact is taken to be \(I=5\) (Very high). With \(M=1\) and fixed bounds \(L_{\min}=0\), \(L_{\max}=T_{\max}\cdot E_{\max}=25\), the discretised likelihoods are:

\[L^{\max}=2,\quad L^{\rm avg}=1,\quad L^{\rm prod}=2.\] Using the 5\(\times\)​5 matrix (3), the risk ratings are:

• Max-based: \(L=2\) (Unlikely) and \(I=5\) (Very high) \(\to\) cell value \(\mathbf{10}\) (Medium).

• Average-based: \(L=1\) (Very unlikely) and \(I=5\) \(\to\) cell value \(\mathbf{5}\) (Medium).

• Attack-tree product: \(L=2\) (Unlikely) and \(I=5\) \(\to\) cell value \(\mathbf{10}\) (Medium).

5.6 Example: Detector-Blinding Attack Kill Chain↩︎

To demonstrate the generalisability of the framework, we apply the same methodology to a detector-blinding attack [5]. In this attack, the adversary sends bright continuous-wave light into the receiver’s single-photon detectors, forcing them out of single-photon (Geiger) mode into linear mode. The adversary then sends tailored “faked-state” pulses that deterministically control detector clicks, allowing full key extraction without introducing detectable errors.

Compared to the PNS kill chain, the detector-blinding scenario has a different resource profile: the attack apparatus uses off-the-shelf optical components rather than quantum non-demolition measurement and quantum memory.

5.6.0.1 Step scores.

We assign base \(T_i\), \(E_i\), and \(m_i\) following the same reference scales (4, 5).

Key differences from the PNS example: detector information (specifications, gating schemes) is often publicly available in vendor documentation (\(E_1=4\)); the blinding apparatus relies on standard optical components (\(T_3=2\), \(E_3=4\)) rather than the specialised quantum hardware required for PNS; and the execution step (\(T_7=3\)) reflects that blinding requires advanced but not specialised quantum expertise, as demonstrated on commercial systems [5]. The “Develop cyber tools” step is shared with the PNS chain, as both attacks require tools to eavesdrop on and parse the classical channel (basis reconciliation, error correction, and privacy amplification data).

5.6.0.2 Aggregate likelihood.

Using the nine step contributions from 7: \[\ell = \{4.0,\;4.0,\;8.0,\;4.0,\;6.4,\;7.2,\;14.4,\;6.0,\;6.0\}.\]

1. Maximum: \[L_{\rm raw}^{\max} = \max_i \ell_i = 14.4.\]

2. Average: \[L_{\rm raw}^{\rm avg} = \frac{1}{9}\sum_{i=1}^{9}\ell_i = \frac{60.0}{9}\approx 6.67.\]

3. Probabilistic (attack-tree product): \[p_i = \{0.16,\;0.16,\;0.32,\;0.16,\;0.256,\;0.288,\;0.576,\;0.24,\;0.24\},\] \[P_{\rm chain} = \prod_{i=1}^{9} p_i \approx 3.21\times10^{-6}.\] With \(M=1\), \(P_{\rm adj}=P_{\rm chain}\). Using the logarithmic discretisation (2), \(\log_{10}(P_{\rm adj})\approx -5.49\), which falls in the \((-6,\;-4]\) bin, giving \(L^{\rm prod}=3\).

5.6.0.3 Discretisation and risk rating.

Using the same fixed bounds as the PNS example (\(L_{\min}=0\), \(L_{\max}=25\), with \(M=1\)) for max and average, the discretised likelihoods are: \[L^{\max}=3,\quad L^{\rm avg}=2,\quad L^{\rm prod}=3.\]

With scenario-level impact \(I=5\) (full key extraction), the risk ratings from 3 are:

• Max-based: \(L=3\), \(I=5\) \(\to\) cell value \(\mathbf{15}\) (High).

• Average-based: \(L=2\), \(I=5\) \(\to\) cell value \(\mathbf{10}\) (Medium).

• Attack-tree product: \(L=3\), \(I=5\) \(\to\) cell value \(\mathbf{15}\) (High).

Comparing with the PNS scenario (5.5), the detector-blinding attack receives higher risk ratings across all three aggregation methods, consistent with its greater practical feasibility. Under the attack-tree product, the blinding chain probability (\(3.21\times10^{-6}\)) is 15\(\times\) higher than the PNS chain probability (\(2.14\times10^{-7}\)), reflecting the feasibility gap: blinding uses off-the-shelf optical components and has been demonstrated on commercial QKD systems [5], while PNS requires quantum non-demolition measurement and quantum memory that do not exist at the required specifications. The modifiers capture this difference: \(m=0.2\) (technology not yet demonstrated) and \(m=0.3\) (decoy-state countermeasure) on the PNS chain versus \(m=1.2\) (combined exploitation synergy) on the blinding execution step.

5.7 Discussion and Practical Implications↩︎

This technique-based model enables rapid, semi-automated risk assessment when constructing kill chains from a structured library of quantum (and classical) attack techniques. Each method is scored using consistent Threat (\(T\)) and Exposure (\(E\)) scales, with context-specific modifiers applied to reflect the real-world operating environment.

• Transparency and Repeatability: The separation of base scores and multipliers ensures that risk assessments are both traceable and auditable. Analysts can clearly justify how each step’s likelihood was derived.

• Comparability Across Scenarios: The fixed discretisation bounds (\(L_{\min}=0\), \(L_{\max}=T_{\max}\cdot E_{\max}\)) produce discretised likelihood values \(L\) that are directly comparable across assessments, independent of the scenario set. This supports objective prioritisation of mitigation efforts.

• Granularity and Targeting: Scoring each technique individually captures the wide variability between simple attacks (e.g., cable cutting) and sophisticated exploits (e.g., photon-number splitting). The most impactful or weakest step in a kill chain can be easily identified and addressed.

• Governance and Actionability: The matrix-based risk ratings map directly to organisational policy thresholds (e.g., ).

• Scalability: The scoring model is independent of the technique database size; new attack surfaces (e.g., quantum sensors, post-quantum cryptographic transitions) can be added without modifying the aggregation methodology.

5.7.0.1 Aggregation Method Selection.

The divergence in risk ratings across aggregation methods is by design — each method answers a different question and should be interpreted accordingly:

• Attack-tree product (primary risk rating): “What is the compound probability of full-chain success?” It directly models the serial AND-logic of kill chains and is grounded in attack-tree and Bayesian attack graph methodology [26]–[28]. We recommend it as the default for all risk assessments.

• Maximum (supplementary safety screening): “Does any single step pose unacceptable risk?” It identifies the weakest link in the chain and is appropriate for conservative, safety-critical screening. However, it is blind to chain length: a 13-step chain with one easy step scores the same as a 3-step chain with an equally easy step. It should not be interpreted as overall scenario likelihood.

• Average (resource heuristic): “What is the typical per-step difficulty?” Because averaging compresses the dynamic range of step-level scores, this method has limited power to discriminate between scenarios and should not be used as a primary risk indicator. It is most useful for estimating the average resource investment required per attack step.

When the max-based and product-based ratings diverge — for example, when \(L^{\max}=3\) but \(L^{\rm prod}=2\) — this signals a chain with one relatively easy step among otherwise difficult ones.

5.7.0.2 Sensitivity to Single-Step Uncertainty.

To illustrate the robustness of the attack-tree product, consider varying the PNS execution step by changing \(m\) from 0.3 to 0.4 (a 33% increase), yielding \(\ell=4\times4\times0.4=6.4\) instead of \(4.8\). Under the max method, \(L^{\max}\) remains at 7.2 (unchanged, since the eavesdropping step dominates). Under the attack-tree product, \(P_{\rm chain}\) changes from \(2.14\times10^{-7}\) to \(2.85\times10^{-7}\), remaining in the same logarithmic bin (\(L^{\rm prod}=2\)). The logarithmic discretisation provides natural robustness to moderate variations in individual step scores, which is desirable when expert-assigned values carry inherent imprecision.

5.7.0.3 Limitations and Validation.

No real-world QKD hacking incidents have been reported to date; all known attacks on QKD, such as PNS, detector blinding, Trojan horse, laser damage, are laboratory proof-of-concept demonstrations. There is no incident database or CVE-like registry for quantum attacks, and no frequency data against which to calibrate likelihood scores. This situation is not unique to quantum risk assessment: when NIST developed SP 800-30 [4] and when the FAIR framework [31] was first proposed, both relied on expert judgment for novel threats rather than historical incident data, and MITRE ATT&CK was published as a structured methodology before extensive empirical validation [2]. ISO/IEC 27005 [13] explicitly states that likelihood may be estimated by expert judgment when statistical data is unavailable. Our \(T\)/\(E\) scoring follows this approach, with the reference scales in 4 providing anchor definitions to reduce subjectivity.

In the absence of incident-frequency data, we evaluate the methodology through two complementary forms of validation appropriate for an emerging-technology risk framework. Internal consistency: across the two case studies, all three aggregation methods produce monotonically consistent relative rankings (detector blinding \(\ge\) PNS), and the sensitivity analysis above shows that the attack-tree product rating is robust to moderate variation in individual step scores. Concurrent validity against expert literature: the relative ranking that the framework assigns to the two scenarios matches the independent expert consensus in the published literature: detector-blinding attacks have been demonstrated end-to-end on commercial QKD systems [5], whereas PNS in its original form requires high-fidelity quantum non-demolition measurement and telecom-wavelength quantum memory that have not been demonstrated at the required specifications, and is in addition rendered information-theoretically ineffective against decoy-state QKD [34], [35]. The framework recovers this consensus quantitatively (blinding chain probability \(1.5\times 10^{1}\) higher than PNS under the attack-tree product) from independently assigned per-step scores, providing concurrent validity in the sense established for assessment instruments without ground-truth incident data. Formal expert elicitation (Delphi-style inter-rater study against the reference scales) and connection to emerging quantum-vulnerability databases are planned as immediate next steps.

5.7.0.4 Reproducibility.

The methodology is fully specified by the formulas, scoring tables, and discretisation rules in 5.2 and 5.4. Each case study is reproducible from the inputs printed in this paper alone: the kill-chain step list (6, 7), the per-step Threat, Exposure, and modifier values, the global multiplier \(M\), the aggregation operators of 5.2, and the discretisation bounds and bins of 2 and 5.3. To enable bit-for-bit replication and re-use on new scenarios, we provide the analysis scripts that compute every numerical value reported in this paper — step likelihoods \(\ell_i\), step probabilities \(p_i\), all three aggregations, the discretisation, and the final risk ratings — as supplementary material; running them on the inputs in 6 and 7 reproduces the reported \(L^{\max}\), \(L^{\rm avg}\), and \(L^{\rm prod}\) values exactly. Re-using the methodology on a new scenario requires only a kill-chain step list and the corresponding \(T_i\), \(E_i\), and \(m_i\) values; no scenario-dependent calibration, hidden parameters, or training data are involved.

5.7.0.5 Cost-Benefit Considerations.

The quantitative risk ratings produced by this framework enable cost-benefit reasoning: organisations can compare the cost of specific countermeasures (e.g., installing optical isolators, upgrading to measurement-device-independent QKD) against the risk reduction they achieve, measured as the change in \(R\). A full cost-benefit analysis is necessarily organisation-specific, depending on asset valuations, countermeasure procurement costs, and operational constraints, and is therefore beyond the scope of this paper.

5.7.0.6 Ethical and Legal Considerations.

The publication of structured attack taxonomies follows the precedent of responsible disclosure established by MITRE ATT&CK and similar threat-intelligence frameworks. The framework is designed to aid defenders; detailed attack parameters and implementation specifics are not published. Quantum technology is increasingly subject to export controls and certification requirements, as reflected in ongoing efforts by ENISA, BSI, and national security agencies to establish quantum-safe standards and certification processes [8], [17].

6 Conclusions↩︎

As quantum communication systems move into operational networks, their security risk management must keep pace. This paper presented a framework that combines kill-chain modelling, quantitative risk assessment, and the SQOUT threat-intelligence platform.

The principal contribution is the shift from isolated vulnerability catalogues to full adversarial pathways. The framework links quantum and classical TTPs into kill chains, exposing how reconnaissance, access, and exploitation phases interact. Aggregation methods compatible with ISO/IEC 27005 translate technique-level assessments into operational risk ratings.

Contextual multipliers allow likelihood scores to reflect site hardening, environmental conditions, and adversary capabilities. SQOUT integrates the taxonomy, scoring, and analysis tools so that analysts can construct, evaluate, and update kill chains as new vulnerabilities emerge.

Several directions remain for further development. The current model assumes independence between attack steps and relies on manually assigned base scores for threat and exposure. Future work will therefore focus on introducing conditional dependencies between attack steps using probabilistic models such as Bayesian networks, as well as improving score calibration through integration with external threat-intelligence sources and expert validation. The framework can also be extended to support configurable risk-aggregation methods and to cover threats to other emerging quantum technologies, including quantum computing and quantum sensing systems.

The approach connects formal analyses of quantum attacks with established risk-assessment processes, providing a basis for operational security governance of quantum communication deployments.

Acknowledgments↩︎

We are grateful to Soumya Das for a thorough review of the manuscript.

References↩︎

---

1. krelina@qudef.com↩︎

2. Note an Open Access SQOUT with selected TTPs is available at https://sqout.qudef.com/.↩︎