Threat Modeling
I have been threat modeling for longer than I have been writing about it, and the one thing I keep coming back to is this: the best time to find a design flaw is before anyone has written the code. Everything on this page is about making that happen, whether you are a developer who has never run a session or a security engineer looking for a framework that fits a system nobody has modeled before.
Pick the path that matches where you are.
New to threat modeling
- What! Think before coding? WHY?: the case for requirements, design and threat modeling before the first commit.
- Threat Modeling Gameplay with EoP: my book, a reference manual for spotting threats in software architecture using the Elevation of Privilege card game.
- Threat Modeling Remotely with Miro and EoP: how to run a session when nobody is in the same room.
- Games with Purpose: security and creativity games worth having on the shelf.
Mapping threats to attack patterns
- CAPEC-STRIDE Mapping: MITRE’s Common Attack Pattern Enumeration and Classification (CAPEC) mapped to the STRIDE categories, so a threat found in a session leads straight to known attack patterns.
Train the trainer: AI-assisted threat modeling
- The Threat Model Was Never the Point: What AI Threat Modeling Does and Doesn’t Do: a train-the-trainer kit for security champions. Five AI threat modeling runs against one system, each missing one ingredient, with the prompts, skills, harness and example output to run the same exercise with your own team.
Threat modeling specific kinds of system
- Threat Modeling AI Systems: A Complete Playbook for Practitioners: the reference document, runbook, template and the Elevation of Autonomy deck for AI, LLM and agentic systems.
- Threat Modeling MCP: the Model Context Protocol, walked through STRIDE, with a worked kill chain.
- Threat Modeling Your Dependencies, Part 1 and Part 2: how one bad library compromises an application, and what to do about it.
Which card deck for which system?
Card games make threat modeling something the whole team does, not something the security team does to them. Each deck covers a different kind of system, so pick by what you are building.
| Deck | Best for | Framework underneath | Where to get it |
|---|---|---|---|
| Elevation of Privilege (EoP) | General software and web architecture | STRIDE | Adam Shostack’s EoP page; my book is the companion reference |
| OWASP Cornucopia | Web and mobile applications, tied to security requirements | OWASP ASVS (web) and MASVS (mobile) | OWASP Cornucopia |
| Elevation of Privacy | Systems handling personal data | T.R.I.M. (Transfer, Retention and Removal, Inference, Minimisation) | F-Secure |
| Elevation of Autonomy (EoA) | AI, LLM and agentic systems, including MCP | OWASP LLM and Agentic Top 10s, LINDDUN, T.R.I.M. | GitHub and the AI playbook |
| Elevation of Email Flow | Email infrastructure: MTAs, gateways, scanners, mailbox services, clients | The email threat taxonomy | Coming soon |
Note to facilitators: you don’t have to pick one. For an AI assistant that reads a mailbox, play EoA for the agent and walk the email taxonomy for the mail flow it touches.
Watch
- Talks, including Behind the Book: Threat Modeling Gameplay with EoP.
New posts on threat modeling land here first. Stay tuned!