Definition
Threat Modeling is a structured approach for identifying, quantifying, and addressing security threats to a system by analyzing its architecture, data flows, and trust boundaries to proactively design security controls.
People Also Ask
Common questions about Threat Modeling answered by our security experts.
Threat Modeling in Practice
Threat modelling is the highest-value security activity that requires no tooling and no budget, and it is the one most consistently skipped. An hour with a design and a whiteboard catches the authorisation flaw that no scanner will ever find, at the point where fixing it costs a conversation rather than a release.
The whole discipline reduces to four questions.
Where the value actually comes from
Not from the methodology. STRIDE, PASTA, attack trees and the rest are scaffolding for the second question; any of them beats none of them, and arguing about which to adopt is a common way to never start.
The value comes from trust boundaries. Every place data crosses from something you control to something you do not — or from a less trusted context to a more trusted one — is where the interesting failures live:
- A user-supplied identifier reaching a database query
- A file upload reaching a parser
- A third-party callback reaching an internal service
- An administrative function reachable by a normal session
- Content from outside your organisation reaching a system that can take action on it
What scanners cannot find, and modelling can
| Flaw class | Found by tooling? |
|---|---|
| Injection where input reaches a sink | Usually |
| Hardcoded secrets | Usually |
| Broken authorisation between accounts | No |
| Business logic abuse | No |
| Missing rate limits on a costly operation | No |
| Trust placed in a client-supplied value | Rarely |
The bottom four are design questions. They are visible on a whiteboard and invisible to a scanner, which is the entire argument for doing this at design time.
STRIDE, as a prompt rather than a process
The most widely used prompt list is STRIDE. Treated as a checklist it is bureaucratic; treated as six questions to ask of each trust boundary it is genuinely useful:
| Prompt | The question at a boundary |
|---|---|
| Spoofing | Can something claim to be something it is not? |
| Tampering | Can data be altered in transit or at rest? |
| Repudiation | Could someone deny having done this, credibly? |
| Information disclosure | Can data leak to a party that should not see it? |
| Denial of service | Can this be made expensive or unavailable? |
| Elevation of privilege | Can a lower-trust actor gain higher-trust capability? |
Fitting it into how teams actually work
Threat modelling fails when it is scheduled as a separate workshop requiring a facilitator and a full day. It succeeds when it is attached to something already happening — design review, or the first refinement of a feature that touches sensitive data.
Keep the output small and durable: the diagram, the threats considered, the decisions taken, and the ones explicitly accepted. A model nobody can find in six months was a conversation, not an artefact.
Where to start
Take one upcoming feature that touches customer or patient data. Draw it, mark the trust boundaries, and walk the four questions. It requires no procurement and it will surface something.
The habit matters more than the artefact. A team that asks the four questions informally at every design discussion will find more than one that produces an immaculate model once a year and never revisits it.
See building security into the development lifecycle and risk assessment methodologies. GuardsArm runs security risk assessments.
Related Terms
Risk Assessment
A risk assessment is the systematic process of identifying, analyzing, and evaluating cybersecurity risks to an organization. It determines the likelihood and potential impact of threats, helping prioritize security investments and mitigation strategies.
Secure SDLC
Secure SDLC (Software Development Lifecycle) is a framework that integrates security activities such as threat modeling, secure coding, security testing, and vulnerability management into every phase of the software development process.
Penetration Testing
Penetration testing (pen testing) is a simulated cyberattack against your computer system, network, or web application to identify exploitable vulnerabilities. Ethical hackers use the same tools and techniques as malicious attackers to find weaknesses before they can be exploited.
Related Reading
Secure Development: Threat Modelling, Code Review and the Pipeline
Security bolted on at the end is a penetration test report nobody has time to act on. Where to intervene in the lifecycle, and what code review can…
Cybersecurity Risk Assessment: Methodologies and Best Practices for Risk Evaluation
Learn about cybersecurity risk assessment: methodologies and best practices for risk evaluation and how it impacts your organization's cybersecurity…
HIPAA Security Rule Risk Analysis: A Practical Approach
The most cited deficiency in HIPAA enforcement is a missing or inadequate risk analysis. What separates one that holds up from a vulnerability scan…
Speak With an Expert
Book a free consultation to discuss threat modeling for your organization.
Related Services
Need Help With Threat Modeling?
Our certified security professionals can help you implement the right threat modeling strategy for your organization. Get a free assessment today.
Book a Free Consultation