Threat Modeling Blog
Threat modeling guides, best practices, and product deep-dives.
How to Get Buy-In for Threat Modeling From a Skeptical Team
You are not arguing against ignorance but against experience, and the only thing that beats evidence is better evidence. Concede the fair objections, ask for ninety minutes, and let the engineers find the flaw themselves.
GuidesHow to Threat Model AWS, Azure, and GCP Cloud Infrastructure
An attacker with the right credential never touches your network — they call the API from their laptop. Model the control plane, make identity the perimeter, and map the escalation paths that need no vulnerability at all.
GuidesHow to Write a Mitigation an Auditor Will Actually Accept
"Improve logging" is an intention, not a control. The six parts of an entry that can be tested — what is true today, where it is enforced, who owns it, and what evidence the control leaves behind by running.
GuidesHow to Prioritize a Backlog of 50+ Threats
A good session over-produces, so half the list is restatements and shared root causes. Collapse it, rank on two axes, band the result instead of ordering all of it, and group the top band by the fix that closes it.
GuidesHow to Threat Model a Mobile App
Your code runs on hardware the attacker owns, so nothing in the binary is a secret and nothing the client enforces is a control. Model the device, what it leaves at rest, and what it exposes to every other app on the phone.
GuidesHow to Threat Model Third-Party Vendor Integrations
You cannot threat model a vendor, only the integration. Find the ones you actually have, classify each by the access it holds, and model what happens on the day the vendor is breached.
GuidesHow to Threat Model Your CI/CD Pipeline
The pipeline can put anything into production without passing a single control in the application model. Draw it as its own system, inventory everyone who can change what it builds, and scope the credentials it hands each job.
GuidesHow to Threat Model a REST API
An API has none of the constraints a user interface quietly enforced. How to build a real endpoint inventory, tier it by exposure, and find the object-level authorization gaps that keep causing breaches.
GuidesHow to Threat Model a Microservices Architecture
The interesting threats live between the services, not inside them. Scope by request path, put the broker and registry on the diagram, and finish by asking what one compromised service reaches next.
GuidesHow to Run Your First Threat Modeling Workshop
Scope it to one feature, draw the diagram beforehand, and sweep each element with STRIDE. A ninety-minute agenda for a first session, and the five things you have to leave the room holding.
GlossaryWhat Is Defense in Depth?
Defense in depth means no single control failure should be fatal. Here's how the layers actually work, why five firewalls isn't defense in depth, and how attack trees show it as math instead of a slogan.
GlossaryWhat Is Attack Surface?
Attack surface is every point where an attacker could try to get in or get data out. Here's how to measure it, why it grows without anyone deciding it should, and how a DFD doubles as an inventory of it.
GlossaryWhat Is Zero Trust Architecture?
Zero Trust replaces "trusted because it's inside the network" with continuous verification of every request. Here's what that principle changes about how you draw trust boundaries in a threat model.
GlossaryWhat Are TTPs?
TTPs — Tactics, Techniques, and Procedures — describe how an adversary actually operates, at three levels of specificity. Here's what each level means and why TTPs outlast an IP address or a file hash.
GlossaryWhat Is a Threat Actor?
A threat actor is whoever might actually attack your system — nation-state, cybercriminal, insider, hacktivist. Here's why naming them before you list threats changes the whole model.
GlossaryWhat Is the OWASP Top 10?
The OWASP Top 10 is a prioritized list of the ten most critical web application risk categories. Here's what's in the 2021 edition and how to use it as a threat modeling checklist, not just a pentest scorecard.
GlossaryWhat Is CAPEC?
CAPEC is MITRE's public catalog of documented attack patterns — the standardized vocabulary for how attackers actually exploit a weakness, and the natural source for attack tree leaf nodes.
GlossaryWhat Is DREAD?
DREAD is Microsoft's original five-factor threat-scoring model — Damage, Reproducibility, Exploitability, Affected Users, Discoverability. Here's how it works and why most teams replaced it with CVSS.
GlossaryWhat Is PASTA?
PASTA is a seven-stage, risk-centric threat modeling process that ties technical threats to business impact, and when to use it over STRIDE.
GlossaryWhat Is LINDDUN?
LINDDUN is a privacy-focused threat modeling framework — seven categories for finding privacy risks that STRIDE's security-only lens misses.
GlossaryWhat Is STRIDE?
STRIDE is Microsoft's six-category threat modeling framework — Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. Here's what each means and how to apply it.
GlossaryWhat Is MITRE ATT&CK?
MITRE ATT&CK is a knowledge base of real-world adversary tactics and techniques, organized into a matrix. Here's how it's structured and how it differs from STRIDE.
GlossaryWhat Is CVSS?
CVSS rates vulnerability severity on a 0-10 scale using exploitability and impact metrics. Here's how the score is calculated and its key limitation for risk prioritization.
GlossaryWhat Is an Attack Tree?
An attack tree breaks a high-level attacker goal down into concrete, ordered attack steps using AND/OR logic. Here's how attack trees work, with a worked example.
GlossaryWhat Is a Trust Boundary?
A trust boundary marks the point where data crosses between zones of differing trust. Here's how to identify them and why they're where most real vulnerabilities live.
GlossaryWhat Is a Risk Register?
A risk register is a living record of identified risks, each scored, owned, and tracked to mitigation. Here's what fields a good risk register needs.
GlossaryWhat Is a Data Flow Diagram (DFD)?
A DFD maps how data moves through a system — processes, data stores, external entities, and trust boundaries. Here's what each element means and why DFDs are the backbone of STRIDE threat modeling.
Threat ModelingThreat Modeling for AI Agents and LLM Applications: A Practical Guide
Why STRIDE and classic DFDs fall short for AI systems, the new trust boundaries agentic and LLM applications introduce, and a worked example combining OWASP LLM/Agentic Top 10 and MITRE ATLAS.
Security StandardsWhy Your Risk Register Needs to Speak ISO 27001 — And How Threat Modeling Gets You There
ISO 27001 is methodology-neutral — it tells you what to document, not how to find risks. Here's how threat modeling fills that gap and produces a register auditors and security teams can both use.
ComplianceClosing the SOC 2 Evidence Gap: Threat Models as Living Compliance Documentation
SOC 2 auditors want continuous evidence of risk management — not a spreadsheet refreshed once a year. Here's how living threat models satisfy TSC CC3.2, CC3.3, and CC9.2.
Risk ManagementThe CVSS Trap: Why Vulnerability Severity Scores Break Down In Your Environment
CVSS scores measure exploitability in a generic context, not risk in your specific architecture. Here's why they mislead patch prioritisation — and how attack trees give you a more defensible picture.
Threat ModelingWhat is Threat Modeling and Why Does It Matter?
A plain-language guide to threat modeling — what it is, why every team needs it, and how to get started with STRIDE, PASTA, and LINDDUN.
Threat ModelingFrom Threat Model to Risk Register — Closing the Loop with ThreatTree
How to turn a completed threat model into an actionable, shareable risk register — and keep it alive as a living document, not a one-time audit.
Threat ModelingHow to Build a Data Flow Diagram (DFD) for Threat Modeling
Step-by-step guide to drawing a DFD: processes, data stores, external entities, trust boundaries, and how they map to STRIDE threat categories.