Presentation of the Carver Matrix

Hi !

The CARVER matrix is a target-analysis and vulnerability-assessment tool originally developed by U.S. Special Forces, now widely adopted in cybersecurity and critical infrastructure protection.

It quantifies the risk exposure of an asset, system, or network by scoring six key criteria:

1. Criticality ($C$): Immediate operational impact if the asset is lost or disabled.
2. Accessibility ($A$): Ease with which an adversary can reach the asset (physical or cyber controls).
3. Recuperability ($R$): Time, effort, and cost required to restore or replace the asset.
4. Vulnerability ($V$): Adversary’s capability to successfully exploit or destroy the asset.
5. Effect ($E$): Broader secondary consequences (financial, reputational, or systemic).
6. Recognizability ($R$): Ease of identifying the asset without extensive reconnaissance.

Assets are scored across each criterion (typically 1 to 5). A high overall score signals a single point of failure or high-value target, allowing defense teams to prioritize defensive investments, patch management, and business continuity planning.

I find the idea of ​​linking this method to cybersecurity quite interesting. We will return to this concept in a future article.

Cheers.