Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE

TL;DR

• I mapped all 231 entries of the software factory threat taxonomy to STRIDE, to CAPEC 3.9 and to CWE 4.20, and checked every CAPEC and CWE ID against MITRE’s published data.
• 53 entries (23%) have a CAPEC attack pattern that describes them directly. 146 have only a generic parent pattern, and 32 have nothing at all.
• STRIDE fits 169 entries cleanly. For the other 62 (27%) it gives a label but not a question anyone would ask in a review.
• STRIDE does better here than on email, because much of the factory is classic access-control and integrity ground. The gaps sit at the factory’s own controls: Scanners and Gates, Provenance and Attestation, Firewall and Quarantine, and SBOM and VEX hold 52 entries, only 3 of them with a direct CAPEC pattern, and half of everything CAPEC misses.
• CWE does much better: 126 entries (55%) have a weakness that names the flaw, and only 10 have none. Of the 24 entries STRIDE and CAPEC both miss, only five escape CWE too. But a weakness catalogue names a flaw once you have found it; it doesn’t help you find it.
• That is the case for a domain taxonomy: STRIDE, CAPEC and CWE tell you what kind of thing went wrong; they don’t tell you where to look in a software factory.

Introduction

In The Factory Is the Target I made a claim: apply STRIDE to a CI/CD design and it will surface something, but it will rarely surface the threats in the taxonomy. A claim like that deserves evidence, so here it is.

Back in 2022 I published a mapping of MITRE’s Common Attack Pattern Enumeration and Classification (CAPEC) to the STRIDE categories, and updated it to CAPEC 3.9 for my book. My earlier mapping of the email threat taxonomy ran the same exercise in the other direction, and this post does it again for the software factory. I took every one of the 231 entries in the taxonomy, the 221 station entries and the 10 structural hazards, and asked three questions:

1. Which STRIDE categories does it belong to, and does STRIDE fit cleanly? A clean fit means a facilitator holding a STRIDE prompt would plausibly ask the question that finds this threat. A loose fit means a category can be assigned, but only after you already know the threat is there.
2. Is there a CAPEC attack pattern for it? Direct means a CAPEC entry describes this attack or a near-exact analogue. Partial means only a generic parent pattern applies. None means CAPEC has nothing that would lead you to it.
3. Is there a CWE weakness for it? Direct means a CWE weakness names the flaw the entry describes, at the Base or Variant level MITRE recommends for mapping, or a Class that is exactly this flaw and that MITRE allows for mapping. Partial means only a broader or adjacent weakness applies. None means no CWE weakness names it.

Every CAPEC ID below was checked against MITRE’s published CAPEC 3.9 data (the STIX bundle in MITRE’s CTI repository), and every CWE ID against the CWE 4.20 release of 30 April 2026, so each ID exists, none is deprecated, and the name is MITRE’s own. The CWE choices also follow MITRE’s guidance on mapping to CWE: nothing MITRE marks as prohibited for mapping, and the entries it discourages only for a Partial match. For CAPEC and CWE, the rating applies to the entry’s list as a whole, and the IDs are in best-fit order, so for a Direct match the first ID names the flaw. The fit ratings are my judgement, and I’d welcome challenges to any of them.

Note to threat modelers: the point of this post is not that STRIDE, CAPEC and CWE are bad. I have spent years building on all three. The point is that they are general-purpose, and a domain like the software factory needs a domain map as well.

What the mapping shows

Across all 231 entries, 53 have a CAPEC pattern that describes them directly, 146 have only a generic parent such as Functionality Bypass, Privilege Abuse or Open-Source Library Manipulation, and 32 have no pattern at all. STRIDE fits 169 entries cleanly and 62 loosely. 24 entries get both a loose STRIDE fit and no CAPEC pattern; those are the ones a general-purpose session is least likely to find. CWE names the flaw directly for 126, gives only a broader or adjacent weakness for 95, and has nothing for 10. Of the 24 entries STRIDE and CAPEC both miss, CWE names seven directly and 12 only broadly; just five are missed by every framework.

STRIDE fit, CAPEC 3.9 match and CWE 4.20 match for each of the 17 stations and the structural hazards, with the number of entries per row that STRIDE and CAPEC both miss, and how many of those CWE misses too. Build Systems, Dependency Resolution and Container Images have the most direct CAPEC patterns; the four control stations, outlined, have at most one each, and turn about half blue for CWE.

The split by station is the interesting part. The stations where the famous attacks happened map well: Build Systems, Dependency Resolution, Container Images, Version Control and Registries. SolarWinds, dependency confusion, typosquatting, repojacking and backdoored images are old, well studied and catalogued, and CAPEC has patterns for them, from Open-Source Library Manipulation (the most cited pattern in this mapping, against 19 entries) to TypoSquatting, Repo Jacking and Spoof Version Control System Commit Metadata. The stations that map worst are the ones we added to make the factory safe:

• The controls. Scanners and Gates, Provenance and Attestation, Firewall and Quarantine, and SBOM and VEX hold 52 entries. Only 3 (6%) have a CAPEC pattern that describes them directly, against 29% at the other 13 stations. They hold 16 of the 32 entries with no pattern at all, and 14 of the 24 that both frameworks miss. CAPEC describes attacks that get past a control (Functionality Bypass is the second most cited pattern, against 16 entries), but not a control that is itself the weakness: a dependency firewall whose cache was filled before the policy existed, an exception that skips every check, a VEX statement that silences a real finding, or an SBOM that nobody can verify. CWE does far better here, naming the flaw directly for 27 of the 52 with weaknesses such as Improper Verification of Cryptographic Signature (CWE-347), Improper Protection of Alternate Path (CWE-424) and Not Failing Securely (CWE-636). That tells you what to call a broken control once you know it is broken. It doesn’t tell you to look at the firewall’s cache.
• SBOM and VEX. This station stands on its own. Eight of its 13 entries have no CAPEC pattern and only a loose STRIDE fit: incomplete inventory, SBOM drift, identifier ambiguity, stale VEX, conversion loss, flat inventory, compliance theatre and the missing supplier SBOM. An SBOM is a claim with an author, and neither STRIDE nor CAPEC has a question about claims. CWE gets closer: Omission of Security-relevant Information (CWE-223) names three of those eight directly (incomplete inventory, conversion loss and flat inventory), and only compliance theatre has no weakness at all. But one weakness covering three different ways an inventory goes wrong is a label, not a question.
• Where STRIDE does well. STRIDE fits 169 entries cleanly, a better rate than for email. Runners, Container Runtime and Orchestration are almost entirely clean, because isolation, privilege and access are exactly the questions STRIDE was built to ask. Tampering appears in 126 entries and Elevation of Privilege in 88, while Denial of Service appears in only 13: the software factory is an integrity problem first.
• Structural hazards. Five of the ten Trumps fit STRIDE only loosely, and nine of them have only a generic CAPEC parent. The one direct match is T1, Evidence Lives Where the Attacker Works, which CAPEC’s Audit Log Manipulation describes well. Patterns such as Names That Move, Running Strangers’ Code Is the Job and The Guard Is Inside the Wall have no CAPEC pattern, because they are not attacks on one component but properties of how the factory is put together. CWE reaches two of them directly, with Modification of Assumed-Immutable Data (CWE-471) for Names That Move and Inclusion of Functionality from Untrusted Control Sphere (CWE-829) for Running Strangers’ Code Is the Job, and has nothing at all for Configuration Is Code.

Note to facilitators: if you run STRIDE on a CI/CD design, add the four control stations of the taxonomy as an explicit second pass: Scanners and Gates, Provenance and Attestation, Firewall and Quarantine, and SBOM and VEX. That is where STRIDE alone leaves you blind, and they are the stations you bought to keep you safe.

Where CWE fits

At first glance CWE closes most of the gap. 126 entries have a weakness that names the flaw, against 53 with a matching attack pattern, and only 10 have nothing at all. If you stopped at the counts, you would conclude that the general frameworks have the factory covered after all.

They don’t, and the reason is in what CWE is. STRIDE prompts you with categories of threat and CAPEC describes attacks; CWE, the Common Weakness Enumeration, is a catalogue of weaknesses, the mistakes in software and design that attacks exploit. It answers “what do we call this flaw?”, not “where should we look?”. Three things in the mapping show the difference:

• A few weaknesses carry a lot of entries. The mapping uses 103 different weaknesses, but the five most cited, Inclusion of Functionality from Untrusted Control Sphere (CWE-829), Download of Code Without Integrity Check (CWE-494), Improper Isolation or Compartmentalization (CWE-653), Execution with Unnecessary Privileges (CWE-250) and Reliance on Insufficiently Trustworthy Component (CWE-1357), appear against 84 of the 231 entries. CWE-829 fits a malicious IDE extension, an unpinned pipeline step and a typosquatted package equally well. It is the right label for all three, and a question for none of them.
• The match comes after the find. Every Direct CWE in the tables was chosen by someone who already knew the threat. Nobody walks a CI/CD design through more than 900 weaknesses; you walk it station by station, and then you reach for the CWE to label what you found.
• What all three miss has the same shape. The five entries that STRIDE, CAPEC and CWE all miss, Definition Drift, Machine Identity Sprawl, Non-Reproducible Output, Compliance Theatre and Canary Blind Spot, are about drift, sprawl and evidence rather than a flaw in one component. CWE has nothing for them because they are not weaknesses in a piece of software; they are properties of how the factory is run.

That is where CWE earns its place: on the finding, not in the session. Use the taxonomy to decide where to look, STRIDE to frame the question, and CWE, with CAPEC where there is a pattern, to label what you find, so that a finding from a threat modeling session lines up with scanner output, CVE records and your issue tracker.

Note to AppSec teams: if your findings already carry CWE IDs from your scanners, tag threat modeling findings the same way. It is the cheapest way to see where design review and tooling overlap, and where only one of them is looking.

The full mapping

STRIDE letters are listed with the best fit first, and CAPEC patterns and CWE weaknesses in best-fit order. Each table gives every entry’s STRIDE categories and fit, and its CAPEC patterns and CWE weaknesses by ID and name. A loose STRIDE fit together with a CAPEC match of None marks the entries a general-purpose session is least likely to find; a CWE match of None means there is not even a weakness to file the finding under. The same tables are on each station’s page in the taxonomy, and the Excel, SKOS and STIX downloads carry the mapping as text you can search and filter.

Line 1: Source to Artifact

01. Workstation and Agents

02. Version Control

03. Pipeline Definition

04. Runners

05. Pipeline Identity and Secrets

06. Build Systems

07. Dependency Resolution

08. Scanners and Gates

09. Provenance and Attestation

Line 2: Artifact to Runtime

10. Registries

11. Firewall and Quarantine

12. SBOM and VEX

13. Infrastructure as Code

14. Container Images

15. Container Runtime

16. Orchestration

17. Delivery and Deployment

Structural hazards

Final thoughts

STRIDE and CAPEC hold up well on the classic ground. If your threat model asks whether someone can tamper with the build, steal the pipeline’s credentials, escape the container or abuse the cluster’s RBAC, you will find most of the Runners, Container Runtime and Orchestration entries. That is not where the interesting failures are.

The entries STRIDE and CAPEC both miss share a shape. They are about the controls themselves (a scanner that is weaponised, a firewall that fails open, a gate that the author can suppress), about drift and time (definition drift, policy drift, vendored copies, stale advisory data, stale VEX, secret and machine identity sprawl), and about claims (an SBOM that is incomplete, a provenance claim that says more than the build did, compliance that is theatre). None of those is an attack on a single component, so none of them shows up when you walk a component through STRIDE.

CWE changes the labels, not the conclusion. It can name the flaw behind more than half the entries, and that matters when a finding has to sit next to a scanner result or a CVE. But it names the flaw after you have found it, and a handful of weaknesses stretch to cover dozens of very different threats. The question of where to look is still open.

That is the argument for a domain taxonomy, and for card games built on one. A general framework tells you what kind of thing went wrong. A domain map tells you where to look.

If you think I have rated a fit too harshly or too kindly, or know a CAPEC pattern or a CWE weakness I missed, tell me on LinkedIn and I’ll update the mapping.

Stay tuned!

References

• The Factory Is the Target: A Threat Taxonomy for the Software Supply Chain (update to the post’s URL once published)
• Software Factory Threat Taxonomy, with a page per station and the full mapping in the Excel, SKOS and STIX downloads
• CAPEC-STRIDE Mapping
• Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE (link once published)
• MITRE CAPEC 3.9, from the STIX 2.1 bundle in the MITRE CTI repository (capec/2.1/stix-capec.json), used to verify every CAPEC ID and name in this post
• MITRE CWE 4.20 (30 April 2026), from the JSON release in the CWE-CAPEC REST API working group repository, used to verify every CWE ID and name in this post
• MITRE’s guidance on mapping to CWE, which sets out which entries may be used for mapping