Threat modeling knowledge baseLearn threat modeling, one concept at a time.
A free learning path through 47 concepts, in the order they build on each other. It starts with what an asset is and ends with threat models kept in version control. Every entry gives a short definition first, then a worked example from the same fictional SaaS app, so you can see how each idea is used on a real system.
- 47 concepts
- 5 levels
- ~4 h of reading
How to use this path
Read in order if you are new. Each level assumes the one before it. Level 01 needs no security background, only a rough idea of how a web application works.
Jump in if you are not. Every entry lists what to read first, so you can start at any concept and follow the links back to fill gaps.
Practise between levels. The concepts stick once you use them. After each level, try them on a system you know, or open the free Invoicely example that every entry refers to.
Level 01
Foundations
Beginner · 10 entries · about 48 min
The vocabulary every security conversation assumes: what you are protecting, from whom, and the basic principles that decide how.
- 01 What Is Threat Modeling? A plain-language guide to threat modeling: what it is, why every team needs it, and how to get started with STRIDE, PASTA, and LINDDUN.
- 02 What Is the CIA Triad? Confidentiality, integrity and availability: the three properties every security control exists to protect.
- 03 What Is an Asset in Cybersecurity? Anything of value an attacker could target. Identifying assets is the step that keeps a threat model focused.
- 04 Threat vs Vulnerability vs Risk: What's the Difference? What could happen, the weakness that allows it, and how likely and damaging it would be.
- 05 What Is a Threat Actor? A threat actor is whoever might attack your system — nation-state, cybercriminal, insider, hacktivist — and why naming them first changes the whole model.
- 06 What Is Attack Surface? Attack surface is every point an attacker could get in or get data out. How to measure it, why it grows unnoticed, and how a DFD doubles as an inventory.
- 07 Authentication vs Authorization: What's the Difference? Authentication proves who you are; authorization decides what you're allowed to do. Most access bugs live in the second.
- 08 What Is the Principle of Least Privilege? Give every user and service only the access it needs, for only as long as it needs it, so one compromise stays small.
- 09 What Is Defense in Depth? Defense in depth means no single control failure is fatal. How the layers work, why five firewalls isn't depth, and how attack trees make it measurable.
- 10 Types of Security Controls: Preventive, Detective, Corrective Preventive, detective and corrective; technical, administrative and physical. How to pick a balanced set of mitigations.
Level 02
Modeling a system
Beginner to intermediate · 10 entries · about 65 min
How to turn a running system into something you can reason about, then find what can go wrong with it, element by element.
- 11 The Four Question Framework for Threat Modeling What are we working on? What can go wrong? What are we going to do about it? Did we do a good job?
- 12 What Is a Data Flow Diagram (DFD)? A Data Flow Diagram (DFD) maps how data moves through a system — processes, data stores, external entities, and trust boundaries.
- 13 What Is a Trust Boundary? A trust boundary marks the point where data crosses between zones of differing trust — where most real vulnerabilities live.
- 14 What Is STRIDE? STRIDE is Microsoft's six-category threat framework — Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege — explained.
- 15 STRIDE per Element: Which Threats Apply Where Which of the six STRIDE categories to ask about processes, data stores, data flows and external entities.
- 16 What Is an Attack Tree? An attack tree breaks a high-level attacker goal into concrete, ordered attack steps using AND/OR logic, with a worked example.
- 17 Abuse Cases and Misuse Cases: Threat Modeling at the User Story Level How to write abuse cases and misuse cases for user stories: a template, worked examples, and how to turn each one into acceptance criteria and a scored threat.
- 18 Threat Modeling Methodologies Compared: STRIDE, PASTA, LINDDUN and More STRIDE, PASTA, LINDDUN, attack trees, OCTAVE, VAST and Trike compared: what each is for, how much effort it takes, and how to combine them.
- 19 What Is PASTA? PASTA is a seven-stage, risk-centric threat modeling process that ties technical threats to business impact, and when to use it over STRIDE.
- 20 What Is LINDDUN? LINDDUN is a privacy-focused threat modeling framework — seven categories for finding privacy risks that STRIDE's security-only lens misses.
Level 03
Scoring and treating risk
Intermediate · 10 entries · about 54 min
Deciding which threats matter, using the public catalogues of weaknesses and vulnerabilities, and recording a decision for each one.
- 21 Risk Matrix for Threat Modeling: How to Score Likelihood and Impact How a 5×5 risk matrix works for threat modeling: likelihood and impact scales your team will score the same way, a worked example, and its pitfalls.
- 22 What Is DREAD? DREAD is Microsoft's five-factor threat-scoring model — Damage, Reproducibility, Exploitability, Affected Users, Discoverability — and why teams moved to CVSS.
- 23 What Is CVSS? CVSS rates vulnerability severity 0-10 using exploitability and impact metrics. How it's calculated, and its key limitation for risk prioritization.
- 24 What Is a CVE? A unique identifier for one publicly disclosed vulnerability in a specific product, such as CVE-2021-44228.
- 25 What Is CWE (Common Weakness Enumeration)? MITRE's catalogue of weakness types, such as CWE-79 cross-site scripting: the root causes behind CVEs.
- 26 What Is CAPEC? CAPEC is MITRE's catalog of documented attack patterns — the standard vocabulary for how attackers exploit a weakness, and a source for attack tree leaf nodes.
- 27 Inherent vs Residual Risk: What's the Difference? Risk before controls, and the risk that's left after them. Residual risk is what someone has to accept.
- 28 Risk Treatment: Mitigate, Avoid, Transfer or Accept The four decisions you can make about a risk: mitigate, avoid, transfer or accept, and how to record each one.
- 29 What Is a Compensating Control? A compensating control is a stand-in mitigation for a risk you can't fix yet -- legitimate only if it actually breaks the attack path, not just visibility.
- 30 What Is a Risk Register? A risk register is a living record of identified risks — each scored, owned, and tracked to mitigation, not a raw list of threats.
Level 04
Attackers and architecture
Advanced · 12 entries · about 68 min
How real attackers operate, and the architecture-level weaknesses that show up again and again in modern web, API and cloud systems.
- 31 What Is MITRE ATT&CK? MITRE ATT&CK is a knowledge base of adversary tactics and techniques, organized into a matrix. How it differs from STRIDE, and how to map to it.
- 32 What Is the Cyber Kill Chain? The Cyber Kill Chain breaks an intrusion into seven stages an attacker has to complete in order -- and defenders only need to break one link, not all seven.
- 33 What Are TTPs? TTPs — Tactics, Techniques, and Procedures — describe how an adversary operates, at three levels of specificity, and why they outlast an IP or file hash.
- 34 What Is the OWASP Top 10? The OWASP Top 10 ranks the ten most critical web app risks. How to use the 2021 edition as a threat modeling checklist, not just a pentest scorecard.
- 35 What Is IDOR (Insecure Direct Object Reference)? Changing an ID in a request returns someone else's data, because the server never checks ownership.
- 36 What Is SSRF (Server-Side Request Forgery)? Tricking a server into making requests for the attacker, often to internal services or cloud credentials.
- 37 OAuth 2.0 Threat Model: Attacks and Defences The ways OAuth 2.0 and OpenID Connect flows get attacked, and the current best practice (RFC 9700) that defends them.
- 38 What Is Secrets Management? How API keys, passwords, tokens and certificates are stored, accessed, rotated and revoked without leaking.
- 39 What Is Zero Trust Architecture? Zero Trust means never trusting a request based on network location alone. Here's what that changes about how you draw trust boundaries in a threat model.
- 40 What Is a Zero-Day Vulnerability? A zero-day is a flaw with no patch yet, but the bigger risk is the n-day window after one ships -- which is why patching was never a complete control.
- 41 What Is an SBOM (Software Bill of Materials)? An SBOM lists every component your software depends on, but a list of ingredients isn't a risk assessment. What it tells you, and what a threat model must add.
- 42 What Is Red Teaming? A red team tests whether you'd detect and stop a real attacker, not just what's vulnerable. How it differs from a pen test and a threat model.
Level 05
Expert practice
Expert · 5 entries · about 27 min
Threat modeling as an engineering discipline: AI systems, models kept in version control, secure-by-design programmes and measuring maturity.
- 43 What Is Prompt Injection? Text that makes an LLM follow an attacker's instructions instead of yours, directly or hidden in content it reads.
- 44 Threat Modeling for AI Agents and LLMs Why STRIDE and classic DFDs fall short for AI systems, the new trust boundaries agentic apps introduce, and a worked OWASP LLM Top 10 + MITRE ATLAS example.
- 45 What Is Threat Modeling as Code? Threat models kept as text in version control, reviewed in pull requests and checked in CI.
- 46 What Is Secure by Design? Security as a design requirement from the start, with the manufacturer, not the customer, carrying the burden.
- 47 Threat Modeling Maturity: How to Measure and Improve How to tell whether your threat modeling practice is improving, using OWASP SAMM levels and useful metrics.
Frequently asked questions
Do I need a security background to use this knowledge base?
No. Level 01 assumes you can describe how a web application works and nothing more. Each entry lists what to read first, so you can also start at any concept and fill in gaps as you go.
How long does the whole learning path take?
Reading every entry takes roughly eight to ten hours. Most people get more from reading one level, then threat modeling a real system they work on, before moving to the next level.
Which threat modeling methodology should I learn first?
Start with the Four Question Framework and STRIDE. They are the most widely used, they need no special tooling, and every other method in Level 02 is easier to understand once you have used them on one system.
Is the knowledge base free?
Yes. Every entry is free to read without an account. Some entries show how a concept appears in ThreatTree, which also has a free plan.
How often is it updated?
Entries are reviewed when the standards they describe change, such as a new OWASP Top 10 or CWE Top 25, and new concepts are added to the path regularly. Each entry shows the date it was last updated.
Put the concepts on a real system
ThreatTree has a data flow diagram editor with trust boundaries, attack trees with AND/OR logic and likelihood × impact scoring, and a risk register filled from your attack trees. The free plan includes four finished example threat models to start from.
Get started free