PASTA — Process for Attack Simulation and Threat Analysis — isn't a mnemonic checklist like STRIDE or LINDDUN. It's a seven-stage methodology, developed by Tony UcedaVelez and Marco Morana, that starts from business objectives and threat intelligence rather than a diagram, and ends with a quantified risk decision a non-technical stakeholder can actually sign off on. Where STRIDE asks "what could go wrong with this element," PASTA asks "what would it cost the business if this specific attack succeeded, and is that acceptable."
Quick definition: PASTA is a risk-centric, seven-stage threat modeling process that moves from business objectives through technical scope, decomposition, threat intelligence, vulnerability analysis, and attack simulation, to a final business-impact-weighted risk decision.
The seven stages
| Stage | Goal | Output |
|---|---|---|
| 1 Define Objectives | Establish business goals, compliance requirements, and risk appetite | Scope and success criteria the rest of the process is measured against |
| 2 Define Technical Scope | Map the application architecture and infrastructure boundary | An inventory of components, dependencies, and technology stack |
| 3 Decomposition | Identify assets, data flows, and trust boundaries | Effectively a DFD — the same artifact STRIDE is built around |
| 4 Threat Analysis | Correlate real threat intelligence to probable threat agents | A prioritised list of threat actors relevant to this specific system |
| 5 Vulnerability Analysis | Map known weaknesses (CVEs, design flaws) to the threats identified | A correlated list of exploitable weaknesses per threat |
| 6 Attack Modeling | Simulate how each threat actor would actually exploit each weakness | Attack trees or attack graphs showing viable attack paths |
| 7 Risk & Impact Analysis | Quantify residual risk and recommend countermeasures | A business-impact-weighted risk register, ready for sign-off |
Why "risk-centric" is the actual differentiator
STRIDE and LINDDUN are both threat-centric: you enumerate what could go wrong per element, then someone downstream decides which findings matter enough to act on. PASTA inverts the order. Stage 1 forces you to define what the business actually cares about protecting — revenue, uptime, a specific compliance obligation — before any technical analysis starts, so that every threat surfaced in stages 4 through 7 is already anchored to a business consequence. Nothing reaches the final risk register without a "so what" attached to it.
This is also what makes PASTA slower. A STRIDE pass over a single DFD can take an afternoon. A full PASTA cycle — gathering real threat intelligence in stage 4, correlating it against actual vulnerabilities in stage 5, building out attack simulations in stage 6 — routinely takes days to weeks. That cost buys you something STRIDE doesn't produce on its own: a risk register your CFO or board can read without a security background.
Stage 6 is where PASTA and attack trees meet
Attack Modeling is PASTA's most concrete stage, and it produces exactly what it sounds like: a simulated attack path from a specific threat actor to a specific weakness, decomposed into ordered steps. That's an attack tree in everything but name — a goal, a sequence of AND/OR steps, and leaf-level actions an attacker would actually need to take. If you're already comfortable building attack trees, you've effectively done PASTA's stage 6 already; the difference is whether stages 1, 4, and 5 fed into it with real business context and real threat intelligence, or whether the goal was chosen ad hoc.
PASTA vs. STRIDE: when to use which
Use STRIDE (optionally with LINDDUN alongside it) for the threat modeling you do routinely — every new feature, every architecture change, every sprint. It's fast enough to run without derailing a release cycle. Reach for PASTA when the stakes justify the overhead: a major system launch, a regulatory audit, an M&A security review, or any situation where you need to walk into a room with executives and justify a security investment in dollars, not CVSS scores. Many mature security teams run both — STRIDE as the default, PASTA for the handful of systems and moments each year where a formal, business-anchored risk case is actually required.
For the framework most teams should learn first, see What Is STRIDE? — and for the privacy-specific counterpart, see What Is LINDDUN?