https://threattree.com/blog/ Threat modeling guides, framework explainers, and practical how-tos from the ThreatTree team. en Mon, 24 Aug 2026 16:25:03 +0000 https://threattree.com/blog/how-to-threat-model-a-microservices-architecture https://threattree.com/blog/how-to-threat-model-a-microservices-architecture Microservices move the interesting threats into the gaps between services. How to scope by request path, draw the right DFD, and adapt the STRIDE sweep. Mon, 24 Aug 2026 00:00:00 +0000 Guides https://threattree.com/blog/how-to-run-your-first-threat-modeling-workshop https://threattree.com/blog/how-to-run-your-first-threat-modeling-workshop A practical playbook for a first threat modeling workshop: what to prepare, who to invite, a 90-minute agenda, and what you must leave the room holding. Mon, 24 Aug 2026 00:00:00 +0000 Guides https://threattree.com/blog/what-is-defense-in-depth https://threattree.com/blog/what-is-defense-in-depth Defense in depth means no single control failure is fatal. How the layers work, why five firewalls isn't depth, and how attack trees make it measurable. Sun, 23 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-attack-surface https://threattree.com/blog/what-is-attack-surface Attack surface is every point an attacker could get in or get data out. How to measure it, why it grows unnoticed, and how a DFD doubles as an inventory. Fri, 21 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-zero-trust-architecture https://threattree.com/blog/what-is-zero-trust-architecture Zero Trust means never trusting a request based on network location alone. Here's what that changes about how you draw trust boundaries in a threat model. Thu, 20 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-are-ttps https://threattree.com/blog/what-are-ttps TTPs — Tactics, Techniques, and Procedures — describe how an adversary operates, at three levels of specificity, and why they outlast an IP or file hash. Wed, 19 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-a-threat-actor https://threattree.com/blog/what-is-a-threat-actor A threat actor is whoever might attack your system — nation-state, cybercriminal, insider, hacktivist — and why naming them first changes the whole model. Tue, 18 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-the-owasp-top-10 https://threattree.com/blog/what-is-the-owasp-top-10 The OWASP Top 10 ranks the ten most critical web app risks. How to use the 2021 edition as a threat modeling checklist, not just a pentest scorecard. Mon, 17 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-capec https://threattree.com/blog/what-is-capec CAPEC is MITRE's catalog of documented attack patterns — the standard vocabulary for how attackers exploit a weakness, and a source for attack tree leaf nodes. Sun, 16 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-dread https://threattree.com/blog/what-is-dread DREAD is Microsoft's five-factor threat-scoring model — Damage, Reproducibility, Exploitability, Affected Users, Discoverability — and why teams moved to CVSS. Sat, 15 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-pasta https://threattree.com/blog/what-is-pasta PASTA is a seven-stage, risk-centric threat modeling process that ties technical threats to business impact, and when to use it over STRIDE. Fri, 14 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-linddun https://threattree.com/blog/what-is-linddun LINDDUN is a privacy-focused threat modeling framework — seven categories for finding privacy risks that STRIDE's security-only lens misses. Fri, 14 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-stride https://threattree.com/blog/what-is-stride STRIDE is Microsoft's six-category threat framework — Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege — explained. Thu, 13 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-mitre-attack https://threattree.com/blog/what-is-mitre-attack MITRE ATT&CK is a knowledge base of adversary tactics and techniques, organized into a matrix. How it differs from STRIDE, and how to map to it. Thu, 13 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-cvss https://threattree.com/blog/what-is-cvss CVSS rates vulnerability severity 0-10 using exploitability and impact metrics. How it's calculated, and its key limitation for risk prioritization. Thu, 13 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-an-attack-tree https://threattree.com/blog/what-is-an-attack-tree An attack tree breaks a high-level attacker goal into concrete, ordered attack steps using AND/OR logic, with a worked example. Thu, 13 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-a-trust-boundary https://threattree.com/blog/what-is-a-trust-boundary A trust boundary marks the point where data crosses between zones of differing trust — where most real vulnerabilities live. Thu, 13 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-a-risk-register https://threattree.com/blog/what-is-a-risk-register A risk register is a living record of identified risks — each scored, owned, and tracked to mitigation, not a raw list of threats. Thu, 13 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/what-is-a-data-flow-diagram https://threattree.com/blog/what-is-a-data-flow-diagram A Data Flow Diagram (DFD) maps how data moves through a system — processes, data stores, external entities, and trust boundaries. Thu, 13 Aug 2026 00:00:00 +0000 Glossary https://threattree.com/blog/threat-modeling-ai-agents https://threattree.com/blog/threat-modeling-ai-agents Why STRIDE and classic DFDs fall short for AI systems, the new trust boundaries agentic apps introduce, and a worked OWASP LLM Top 10 + MITRE ATLAS example. Sat, 08 Aug 2026 00:00:00 +0000 Guides https://threattree.com/blog/threat-model-iso27001-risk-register https://threattree.com/blog/threat-model-iso27001-risk-register ISO 27001's risk clause is methodology-neutral. Here's how threat modeling fills that gap with a register auditors and security teams can both use. Mon, 25 May 2026 00:00:00 +0000 Compliance https://threattree.com/blog/soc2-threat-model-compliance-evidence https://threattree.com/blog/soc2-threat-model-compliance-evidence SOC 2 auditors want continuous evidence of risk management, not a yearly spreadsheet. Here's how living threat models satisfy TSC CC3.2, CC3.3, and CC9.2. Mon, 25 May 2026 00:00:00 +0000 Compliance https://threattree.com/blog/cvss-scores-vs-threat-model-risk https://threattree.com/blog/cvss-scores-vs-threat-model-risk CVSS measures generic exploitability, not risk in your architecture. Here's why it misleads patch prioritisation — and how threat models fix that. Mon, 25 May 2026 00:00:00 +0000 Opinion https://threattree.com/blog/what-is-threat-modeling https://threattree.com/blog/what-is-threat-modeling A plain-language guide to threat modeling: what it is, why every team needs it, and how to get started with STRIDE, PASTA, and LINDDUN. Tue, 19 May 2026 00:00:00 +0000 Guides https://threattree.com/blog/threat-model-to-risk-register https://threattree.com/blog/threat-model-to-risk-register How to turn a completed threat model into an actionable risk register, prioritise by severity, and keep it alive as your system evolves. Tue, 19 May 2026 00:00:00 +0000 Guides https://threattree.com/blog/how-to-build-a-dfd https://threattree.com/blog/how-to-build-a-dfd Step-by-step guide to drawing a DFD for threat modeling: processes, data stores, trust boundaries, and how they map to STRIDE categories. Tue, 19 May 2026 00:00:00 +0000 Guides