Threat Modeling Blog
Threat modeling guides, best practices, and product deep-dives.
How to Do a TARA Under ISO/SAE 21434 (Worked Example)
How to do a TARA under ISO/SAE 21434, step by step: assets, damage and threat scenarios, attack paths, feasibility, risk values and treatment, with an example.
ComplianceNIS2 and Threat Modeling: Meeting Article 21 With Evidence
How threat modeling meets NIS2: who is in scope (including SaaS suppliers), what Article 21 requires, a mapping to each measure, and what it won't cover.
GuidesHow to Threat Model a Kubernetes Cluster
Kubernetes adds a control plane, a flat pod network and service account tokens to your threat model. How to draw a cluster, find its threats and score them.
GuidesRisk Matrix for Threat Modeling: How to Score Likelihood and Impact
How a 5×5 risk matrix works for threat modeling: likelihood and impact scales your team will score the same way, a worked example, and its pitfalls.
GuidesAttack Tree Examples: 5 Worked Trees for Common Attacker Goals
Five worked attack tree examples: account takeover, cloud storage theft, ransomware, payment fraud and CI/CD compromise, each scored and explained.
GuidesAbuse Cases and Misuse Cases: Threat Modeling at the User Story Level
How to write abuse cases and misuse cases for user stories: a template, worked examples, and how to turn each one into acceptance criteria and a scored threat.
GuidesThreat Model Example: A Complete Walkthrough for a SaaS Web App
A complete threat model example for a SaaS web app: scope, data flow diagram, STRIDE threats, an attack tree, scoring and the final risk register.
GuidesThreat Modeling Checklist: 40 Questions for Every Design Review
A practical threat modeling checklist: 40 questions to ask before, during and after a design review, organised by STRIDE plus trust boundaries and privacy.
GuidesThreat Modeling Methodologies Compared: STRIDE, PASTA, LINDDUN and More
STRIDE, PASTA, LINDDUN, attack trees, OCTAVE, VAST and Trike compared: what each is for, how much effort it takes, and how to combine them.
OpinionWhy Most Risk Registers Are Actually Just Backlogs
A list of open tickets with a severity column isn't a risk register. Seven signs yours has become a backlog, and how to turn it back into a register.
GuidesBest Threat Modeling Software in 2026: 10 Tools Compared
An honest comparison of 10 threat modeling tools: free, open-source and commercial. Pricing, platforms, how each finds threats, and who each one suits.
OpinionAI-Assisted Threat Modeling: Where LLMs Help and Where They Don't
LLMs are good at breadth and bad at knowing your system. Where AI helps a threat model, where it misleads, and a workflow that keeps the risk calls human.
GuidesHow to Threat Model an SSO / Identity Provider Integration
SSO moves the login to your IdP, not the trust decision. How to model SAML and OIDC flows, account linking, per-tenant IdPs and sessions that outlive access.
ComplianceGDPR and Threat Modeling: Where Privacy Engineering Meets STRIDE
STRIDE covers GDPR's security duties but not its privacy principles. Where a threat model meets Articles 25, 32 and 35, and where LINDDUN fills the gap.
GlossaryWhat Is Red Teaming?
A red team tests whether you'd detect and stop a real attacker, not just what's vulnerable. How it differs from a pen test and a threat model.
GuidesHow to Threat Model a Serverless Architecture
Serverless removes the servers from your diagram, not from your threat model. How to model event triggers, function roles, warm state and denial of wallet.
OpinionThe Insider Threat Nobody Threat Models
Most threat models trust everyone inside the company. How to model malicious, careless and compromised insiders without treating your colleagues as villains.
ComplianceSOC 2 vs. ISO 27001: Which Do You Need First?
SOC 2 is an attestation report US buyers ask for; ISO 27001 is a certificate recognised worldwide. How they differ, where they overlap, and how teams choose.
GuidesHow to Threat Model a GraphQL API
GraphQL folds a whole API into one endpoint and moves the attack surface into the schema. How to threat model resolver authorization, query cost and federation.
GlossaryWhat Is an SBOM (Software Bill of Materials)?
An SBOM lists every component your software depends on -- but a list of ingredients isn't a risk assessment. What it tells you, what it doesn't, and where a threat model picks up the rest.
GuidesHow to Threat Model a Multi-Tenant SaaS Application
In a multi-tenant app the question isn't just can an attacker get in -- it's can Tenant A ever touch Tenant B's data. How to threat model the isolation boundary that actually matters.
GlossaryWhat Is a Zero-Day Vulnerability?
A zero-day is a flaw with no patch available -- but the bigger real-world risk is the n-day window afterward, which is exactly why patching alone was never a complete control.
GlossaryWhat Is the Cyber Kill Chain?
The Cyber Kill Chain breaks an intrusion into seven stages an attacker has to complete in order -- and defenders only need to break one link, not all seven.
GlossaryWhat Is a Compensating Control?
A compensating control is a stand-in mitigation for a risk you can't fix yet -- legitimate only if it actually breaks the attack path, not just visibility.
GuidesWhen Should You Re-Threat-Model? A Practical Trigger List
A threat model goes stale the moment nothing updates it. Ten concrete triggers for when to revisit one -- not a quarterly calendar reminder.
OpinionBuilding a Security Culture Without a Dedicated Security Team
No security team doesn't mean no security decisions -- it means they're already being made informally, by whoever noticed first. How to make that practice explicit, shared, and repeatable without a headcount.
OpinionRansomware Threat Modeling: What Most Companies Get Wrong
Colonial Pipeline, Kaseya, and Maersk show the same pattern: the ransomware family barely matters. What decides the outcome is architecture decided months earlier, and most models never test it.
OpinionSupply Chain Security: Threat Modeling Your Dependencies
Your DFD stops at the edge of your own code. SolarWinds, dependency confusion, and the xz-utils backdoor show three different trust assumptions in everything underneath it that nobody drew.
Opinion7 Threat Modeling Mistakes Even Experienced Teams Make
These aren't beginner mistakes -- they're what happens after a team gets good enough at threat modeling to stop questioning its own process. Seven habits that quietly hollow out a mature practice.
OpinionThe Real Cost of Skipping Threat Modeling (With Breach Case Studies)
Capital One, Target, and Equifax each trace back to a design question nobody asked in time. What each breach actually cost, the question that would have surfaced it, and where the argument overreaches.
OpinionShift-Left Security: Why Threat Modeling Belongs at Design Time
The industry shifted its scanners left and left the decisions where they were. What actually has to move, the flaws no tool can see because the code is doing exactly what it was told, and why the slogan keeps failing.
OpinionThreat Modeling vs. Penetration Testing: What's the Difference?
A pen test finds what is exploitable in what you built; a threat model finds what you should never have built that way. Where each one is structurally blind, and how to wire them together.
GuidesHow to Get Buy-In for Threat Modeling From a Skeptical Team
You are not arguing against ignorance but against experience, and the only thing that beats evidence is better evidence. Concede the fair objections, ask for ninety minutes, and let the engineers find the flaw themselves.
GuidesHow to Threat Model AWS, Azure, and GCP Cloud Infrastructure
An attacker with the right credential never touches your network — they call the API from their laptop. Model the control plane, make identity the perimeter, and map the escalation paths that need no vulnerability at all.
GuidesHow to Write a Mitigation an Auditor Will Actually Accept
"Improve logging" is an intention, not a control. The six parts of an entry that can be tested — what is true today, where it is enforced, who owns it, and what evidence the control leaves behind by running.
GuidesHow to Prioritize a Backlog of 50+ Threats
A good session over-produces, so half the list is restatements and shared root causes. Collapse it, rank on two axes, band the result instead of ordering all of it, and group the top band by the fix that closes it.
GuidesHow to Threat Model a Mobile App
Your code runs on hardware the attacker owns, so nothing in the binary is a secret and nothing the client enforces is a control. Model the device, what it leaves at rest, and what it exposes to every other app on the phone.
GuidesHow to Threat Model Third-Party Vendor Integrations
You cannot threat model a vendor, only the integration. Find the ones you actually have, classify each by the access it holds, and model what happens on the day the vendor is breached.
GuidesHow to Threat Model Your CI/CD Pipeline
The pipeline can put anything into production without passing a single control in the application model. Draw it as its own system, inventory everyone who can change what it builds, and scope the credentials it hands each job.
GuidesHow to Threat Model a REST API
An API has none of the constraints a user interface quietly enforced. How to build a real endpoint inventory, tier it by exposure, and find the object-level authorization gaps that keep causing breaches.
GuidesHow to Threat Model a Microservices Architecture
The interesting threats live between the services, not inside them. Scope by request path, put the broker and registry on the diagram, and finish by asking what one compromised service reaches next.
GuidesHow to Run Your First Threat Modeling Workshop
Scope it to one feature, draw the diagram beforehand, and sweep each element with STRIDE. A ninety-minute agenda for a first session, and the five things you have to leave the room holding.
GlossaryWhat Is Defense in Depth?
Defense in depth means no single control failure should be fatal. Here's how the layers actually work, why five firewalls isn't defense in depth, and how attack trees show it as math instead of a slogan.
GlossaryWhat Is Attack Surface?
Attack surface is every point where an attacker could try to get in or get data out. Here's how to measure it, why it grows without anyone deciding it should, and how a DFD doubles as an inventory of it.
GlossaryWhat Is Zero Trust Architecture?
Zero Trust replaces "trusted because it's inside the network" with continuous verification of every request. Here's what that principle changes about how you draw trust boundaries in a threat model.
GlossaryWhat Are TTPs?
TTPs — Tactics, Techniques, and Procedures — describe how an adversary actually operates, at three levels of specificity. Here's what each level means and why TTPs outlast an IP address or a file hash.
GlossaryWhat Is a Threat Actor?
A threat actor is whoever might actually attack your system — nation-state, cybercriminal, insider, hacktivist. Here's why naming them before you list threats changes the whole model.
GlossaryWhat Is the OWASP Top 10?
The OWASP Top 10 is a prioritized list of the ten most critical web application risk categories. Here's what's in the 2021 edition and how to use it as a threat modeling checklist, not just a pentest scorecard.
GlossaryWhat Is CAPEC?
CAPEC is MITRE's public catalog of documented attack patterns — the standardized vocabulary for how attackers actually exploit a weakness, and the natural source for attack tree leaf nodes.
GlossaryWhat Is DREAD?
DREAD is Microsoft's original five-factor threat-scoring model — Damage, Reproducibility, Exploitability, Affected Users, Discoverability. Here's how it works and why most teams replaced it with CVSS.
GlossaryWhat Is PASTA?
PASTA is a seven-stage, risk-centric threat modeling process that ties technical threats to business impact, and when to use it over STRIDE.
GlossaryWhat Is LINDDUN?
LINDDUN is a privacy-focused threat modeling framework — seven categories for finding privacy risks that STRIDE's security-only lens misses.
GlossaryWhat Is STRIDE?
STRIDE is Microsoft's six-category threat modeling framework — Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. Here's what each means and how to apply it.
GlossaryWhat Is MITRE ATT&CK?
MITRE ATT&CK is a knowledge base of real-world adversary tactics and techniques, organized into a matrix. Here's how it's structured and how it differs from STRIDE.
GlossaryWhat Is CVSS?
CVSS rates vulnerability severity on a 0-10 scale using exploitability and impact metrics. Here's how the score is calculated and its key limitation for risk prioritization.
GlossaryWhat Is an Attack Tree?
An attack tree breaks a high-level attacker goal down into concrete, ordered attack steps using AND/OR logic. Here's how attack trees work, with a worked example.
GlossaryWhat Is a Trust Boundary?
A trust boundary marks the point where data crosses between zones of differing trust. Here's how to identify them and why they're where most real vulnerabilities live.
GlossaryWhat Is a Risk Register?
A risk register is a living record of identified risks, each scored, owned, and tracked to mitigation. Here's what fields a good risk register needs.
GlossaryWhat Is a Data Flow Diagram (DFD)?
A DFD maps how data moves through a system — processes, data stores, external entities, and trust boundaries. Here's what each element means and why DFDs are the backbone of STRIDE threat modeling.
Threat ModelingThreat Modeling for AI Agents and LLM Applications: A Practical Guide
Why STRIDE and classic DFDs fall short for AI systems, the new trust boundaries agentic and LLM applications introduce, and a worked example combining OWASP LLM/Agentic Top 10 and MITRE ATLAS.
Security StandardsWhy Your Risk Register Needs to Speak ISO 27001 — And How Threat Modeling Gets You There
ISO 27001 is methodology-neutral — it tells you what to document, not how to find risks. Here's how threat modeling fills that gap and produces a register auditors and security teams can both use.
ComplianceClosing the SOC 2 Evidence Gap: Threat Models as Living Compliance Documentation
SOC 2 auditors want continuous evidence of risk management — not a spreadsheet refreshed once a year. Here's how living threat models satisfy TSC CC3.2, CC3.3, and CC9.2.
Risk ManagementThe CVSS Trap: Why Vulnerability Severity Scores Break Down In Your Environment
CVSS scores measure exploitability in a generic context, not risk in your specific architecture. Here's why they mislead patch prioritisation — and how attack trees give you a more defensible picture.
Threat ModelingWhat is Threat Modeling and Why Does It Matter?
A plain-language guide to threat modeling — what it is, why every team needs it, and how to get started with STRIDE, PASTA, and LINDDUN.
Threat ModelingFrom Threat Model to Risk Register — Closing the Loop with ThreatTree
How to turn a completed threat model into an actionable, shareable risk register — and keep it alive as a living document, not a one-time audit.
Threat ModelingHow to Build a Data Flow Diagram (DFD) for Threat Modeling
Step-by-step guide to drawing a DFD: processes, data stores, external entities, trust boundaries, and how they map to STRIDE threat categories.
No posts in this category yet.