Ask how to start threat modeling and you'll get a list of acronyms: STRIDE, PASTA, LINDDUN, DREAD, OCTAVE, VAST, Trike, ATT&CK. Most articles then compare them as if they were rival products and you had to pick one. That's the main source of confusion, because they mostly aren't alternatives. Some find threats, some score them, some describe attacker behaviour, and some organise the whole exercise.
This guide sorts them into those groups first, then compares the ones that genuinely compete, and ends with the combination most working teams actually use.
The short version: start with a data flow diagram and walk it through STRIDE. Add LINDDUN if the system handles personal data. Decompose the few threats that matter into attack trees, score them on likelihood and impact, and tag them with MITRE ATT&CK or CAPEC. Reach for PASTA when a system is critical enough to justify weeks of risk-centric analysis, and OCTAVE when the question is about the whole organisation rather than one system.
Four different kinds of "methodology"
Before comparing anything, it helps to see that the usual list mixes four kinds of tool. Comparing STRIDE with DREAD is like comparing a checklist with a ruler: you'll probably want both.
| Kind | What it answers | Examples |
|---|---|---|
| Process frameworks | How do we run a threat model from start to finish? | The four-question framework, PASTA, OCTAVE, VAST, Trike |
| Threat elicitation | What could go wrong with this part of the system? | STRIDE, LINDDUN, attack trees |
| Risk scoring | How bad is this threat, and what do we fix first? | Likelihood × impact, DREAD, CVSS |
| Knowledge bases | What do real attackers actually do? | MITRE ATT&CK, MITRE ATLAS, CAPEC, OWASP Top 10 |
A complete threat model uses something from most rows. The real choices are which process to follow, which elicitation method fits the system, and how you score.
The methodologies at a glance
| Method | Focus | Effort | Best for | Main output |
|---|---|---|---|---|
| STRIDE | Security threats per element | Hours per system | Software teams; the default starting point | Threat list mapped to the DFD |
| LINDDUN | Privacy threats per element | Hours per system | Anything processing personal data | Privacy threat list mapped to the DFD |
| Attack trees | How one goal can be reached | An hour or two per tree | Your most serious threats | AND/OR decomposition of attack paths |
| PASTA | Business risk and attack simulation | Weeks per cycle | Critical systems with dedicated security staff | Risk analysis tied to business impact |
| OCTAVE | Organisational operational risk | Workshops over weeks | Enterprise risk programmes | Organisation-wide risk profile |
| VAST | Scaling across many teams | Tool-dependent | Large organisations using ThreatModeler | Application and operational models |
| Trike | Acceptable risk per asset and actor | Days | Teams that want a formal requirements model | Requirements and risk model |
Threat elicitation methods
STRIDE
STRIDE was developed at Microsoft in the late 1990s and is still the most widely used method. It's a mnemonic for six threat categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege), each the violation of a security property such as authenticity or integrity. You apply it to every element of a data flow diagram: for each process, data store, external entity and flow, ask which categories apply.
- Strengths: fast to learn, repeatable, and maps directly onto a diagram. Two engineers running it on the same DFD land on largely the same list.
- Limits: it finds categories of threat, not their severity, and it says nothing about privacy harm or about how individual steps chain into an attack.
LINDDUN
LINDDUN, from KU Leuven, does for privacy what STRIDE does for security. Its seven categories (Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness and Non-compliance) are applied to the same DFD. It catches harms STRIDE misses entirely, such as a system that works exactly as designed but lets two datasets be joined to identify someone. Our post on GDPR and threat modeling shows how the two fit together.
- Strengths: the only widely used method built for privacy; uses the same diagram, so it adds little overhead.
- Limits: not a security method, so it's a complement to STRIDE, never a replacement.
Attack trees
Attack trees, popularised by Bruce Schneier in the late 1990s, start from one attacker goal and decompose it into the ways it could be reached. OR nodes are alternatives; AND nodes are steps that must all succeed. Where STRIDE gives you breadth, an attack tree gives you depth on a single threat, and shows which one control breaks several paths at once.
- Strengths: makes reasoning visible to engineers, leadership and auditors; natural place to score likelihood and impact per step.
- Limits: one tree per goal, so you build them for the threats that matter, not for everything.
Process frameworks
The four-question framework
Adam Shostack's framework isn't a method so much as the skeleton most methods share: What are we working on? What can go wrong? What are we going to do about it? Did we do a good job? If you're unsure which process to follow, follow this one and plug STRIDE, attack trees and a scoring scheme into the second and third questions.
PASTA
PASTA (Process for Attack Simulation and Threat Analysis), developed by Tony UcedaVélez and Marco Morana, is a seven-stage, risk-centric process. It starts with business objectives and technical scope, works through application decomposition, threat intelligence and vulnerability analysis, and ends with attack modeling and risk and impact analysis. Where STRIDE asks "what could go wrong?", PASTA asks "what could go wrong that the business would actually care about, given who is likely to attack us?"
- Strengths: ties every threat to business impact, which makes prioritisation and budget conversations much easier.
- Limits: a full cycle takes weeks and needs threat intelligence and security expertise most small teams don't have.
Stage six, attack modeling, is an attack tree in all but name. That's why many teams borrow PASTA's business framing for their crown-jewel systems without running all seven stages everywhere. See What is PASTA? for the stages in detail.
OCTAVE
OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) comes from Carnegie Mellon's Software Engineering Institute and CERT. It's an organisational risk assessment: workshops identify critical assets, the threats to them and the organisation's vulnerabilities, across people and processes as well as technology. OCTAVE Allegro is a streamlined variant focused on information assets.
- Strengths: designed for enterprise risk management and for non-technical stakeholders.
- Limits: too broad for designing a single application; it won't tell an engineer what to change in an API.
VAST
VAST (Visual, Agile, and Simple Threat modeling) aims to scale threat modeling across an enterprise by separating application models, built by development teams, from operational models of infrastructure. It comes from ThreatModeler and is closely tied to that commercial tool, so in practice choosing VAST and choosing ThreatModeler tend to be the same decision. Our ThreatModeler comparison covers when that fits.
Trike
Trike is an open-source, risk-based methodology built around a requirements model: who (actors) may do what (create, read, update, delete) to which assets, and what level of risk is acceptable for each. Threats are then derived as violations of those rules. It's rigorous and auditable, but it's less widely used today than STRIDE or PASTA, and its original tooling has seen little development in recent years.
Scoring models
Finding threats is half the job; you also need to decide which to fix first. Three approaches dominate.
- Likelihood × impact. Rate each on a 1–5 scale and multiply. Simple, explainable, and what most risk registers and auditors expect. Its weakness is that "likelihood" is a judgment; scoring each step of an attack tree, rather than the threat as a whole, makes it more grounded.
- DREAD. Microsoft's five-factor model (Damage, Reproducibility, Exploitability, Affected users, Discoverability). Microsoft moved away from it because reviewers scored the same threat very differently, and few teams use it now.
- CVSS. The standard for scoring known vulnerabilities. Useful when a threat maps to a vulnerability class, but its base score ignores your environment; our post on the CVSS trap explains why it shouldn't be your only measure.
Knowledge bases
MITRE ATT&CK, its AI counterpart MITRE ATLAS, CAPEC and the OWASP Top 10 are catalogues, not methods. They describe what attackers really do in a shared vocabulary. Their place in a threat model is as tags: when STRIDE surfaces a spoofing threat on a login flow, tagging it T1110 (Brute Force) and CAPEC-600 (Credential Stuffing) makes it specific, searchable and comparable with detection and testing work.
How to choose
| If you are… | Start with |
|---|---|
| A software team doing its first threat model | Four questions + DFD + STRIDE, then attack trees for the top threats |
| Processing personal or health data | Add LINDDUN alongside STRIDE on the same DFD |
| Protecting a critical system with dedicated security staff | PASTA, or at least its business-objective and attack-modeling stages |
| Running an organisation-wide risk assessment | OCTAVE or OCTAVE Allegro, feeding your risk register |
| Building AI or LLM features | STRIDE for the surrounding system, plus the OWASP LLM Top 10 and MITRE ATLAS; see threat modeling AI agents |
| Preparing for ISO 27001 or SOC 2 | Any of the above, as long as threats end up scored in a register with treatment decisions; see ISO 27001 and your risk register |
The combination most teams settle on
After a few cycles, most teams that do this well converge on a similar stack, whatever they called it at the start:
- Frame it with the four questions, so everyone knows what the session is for and when it's done.
- Draw a DFD with trust boundaries and walk each element through STRIDE, adding LINDDUN where personal data flows. Our DFD guide covers the drawing.
- Pick the threats that matter and decompose each into an attack tree, tagged with ATT&CK or CAPEC.
- Score each attack step on likelihood and impact, and record a treatment decision and an owner in a risk register.
- Revisit it when the system changes, using the triggers in when to re-threat-model.
That's breadth from STRIDE, depth from attack trees, prioritisation from scoring and shared vocabulary from the knowledge bases. It borrows PASTA's discipline of tying threats to business impact without paying for all seven stages on every system.
Common mistakes
- Debating methodologies instead of modeling. A rough STRIDE pass this week beats a perfect PASTA plan next quarter.
- Treating a scoring model as a method. DREAD or CVSS on a list nobody built systematically just gives you precise numbers for an incomplete list.
- Running STRIDE on the whole system at once. It only works per element; applied to "the platform" it produces vague threats nobody owns.
- Stopping at the list. Every method above is wasted if threats don't end up with a score, a decision and an owner.
Frequently asked questions
What is the most common threat modeling methodology?
STRIDE. It was developed at Microsoft in the late 1990s, it's quick to learn, and it's applied element by element to a data flow diagram, which makes it the usual starting point for software teams.
What is the difference between STRIDE and PASTA?
STRIDE is a checklist of six threat categories that you apply to each element of a system diagram, usually in an afternoon. PASTA is a seven-stage, risk-centric process that starts from business objectives and threat intelligence and ends with attack simulation and risk analysis; a full cycle takes weeks. Many teams use STRIDE for breadth and borrow PASTA's business-impact framing for their most critical systems.
Is MITRE ATT&CK a threat modeling methodology?
No. MITRE ATT&CK is a knowledge base of real-world adversary tactics and techniques. It doesn't tell you how to run a threat model, but it's very useful inside one: you tag the threats you find with ATT&CK technique IDs so they're described in a shared, specific vocabulary. CAPEC plays the same role for attack patterns.
Is DREAD still used?
Rarely. DREAD is a scoring model rather than a way of finding threats, and Microsoft moved away from it internally because different reviewers gave the same threat very different scores. Most teams now use a simple likelihood and impact rating, or CVSS for threats that map to a known vulnerability class.
Can you combine threat modeling methodologies?
Yes, and most mature teams do. A common combination is a data flow diagram walked through STRIDE (plus LINDDUN where personal data is involved), attack trees for the threats that matter most, a likelihood and impact score for each, and MITRE ATT&CK or CAPEC tags so findings use a shared vocabulary.
Choosing a tool to run these in? Our guide to the best threat modeling software in 2026 covers how each tool finds threats. For a ready-made starting point, the free templates include a DFD, an attack tree and a STRIDE risk register.