> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Threat Taxonomies

- URL: taxonomies
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T14:51:30.530Z
- Description: Threat taxonomies for threat modeling email infrastructure and the software factory: each threat with a mitigation principle and design measures.
- Author: Brett Crawley

General-purpose frameworks such as STRIDE tell you what kind of thing went wrong. A domain taxonomy tells you where to look. These are threat taxonomies for two parts of a system that the general frameworks reach only partly: the machinery that delivers email, and the software factory that builds and ships software.

Each entry states a threat as a property of a component or a design decision, the principle a sound design follows, and two to four concrete design measures. Each taxonomy is the reference for one of my threat modeling card games, and shares its references with the game.

## [Email infrastructure](/taxonomies/email-infrastructure/)

![Email Infrastructure Threat Taxonomy: the path a message takes through the nine layers of the email stack](https://www.ostering.com/media/posts/91/email-00-overview-1920x1080.png =1920x1080)

**117 threats across nine layers of the email stack, plus 8 structural hazards.** The SMTP conversation, sender authentication, DNS, MIME, the delivery pipeline, content scanners, the human-facing layer, client protocols, and operations and storage. The reference for the card game Elevation of Email Flow.

[Open the email infrastructure taxonomy](/taxonomies/email-infrastructure/) · [Read the article](/the-unmodeled-attack-surface)

## [Software factory](/taxonomies/software-factory/)

![Software Factory Threat Taxonomy: the two production lines of stations and the structural hazards](https://www.ostering.com/media/posts/91/sf-00-overview-1920x1080.png =1920x1080)

**221 threats at 17 stations of the software factory, plus 10 structural hazards.** From the developer's laptop and its agents to the last hop into production, including the security controls themselves. The reference for the card game Software Factory.

[Open the software factory taxonomy](/taxonomies/software-factory/) · [Read the article](/the-factory-is-the-target/)

## Formats and licence

Each taxonomy has a page per layer or station, and downloads in four formats: a PDF to read and print, an Excel workbook to work in, a SKOS (JSON-LD) file for linked data, and a STIX 2.1 bundle for security tools. Each overview page lists them.

Both taxonomies are licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: you can share them freely for non-commercial purposes, threat model with them (including for paying clients), use them internally and for training in any organisation, and quote entries with credit in paid work. Shipping a taxonomy in a product needs permission. The full terms are on each overview page.