# Threat Modeling

> Threat Modelling

- Skill: `dstreefkerk/threat-modeling` (Agent Skill, multi-file: 80 files)
- Install (CLI): `npx skillmds@latest add dstreefkerk/threat-modeling`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dstreefkerk/threat-modeling/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: dstreefkerk (https://skillmd.com/u/dstreefkerk)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/dstreefkerk/threat-modeling

---


# Threat Modelling

> Source: Shostack, *Threat Modeling: Designing for Security* (Wiley, 2014). All citations point back to chapters and sections in that book.

This skill is a comprehensive reference for **design-time threat modelling**. It is organised as a router — this SKILL.md tells you what reference files to read for any threat-modelling task. The references contain the detail.

## The Four Questions

Every threat-modelling activity reduces to four questions. Always anchor your work here:

1. **What are we working on?** Model the system. Almost always: a Data Flow Diagram (DFD) with trust boundaries. See *DFDs and trust boundaries* below.
2. **What can go wrong?** Find threats. Several techniques — STRIDE, attack trees, attack libraries, LINDDUN. See `references/stride.md`, `references/attack-trees.md`, `references/attack-libraries.md`, `references/privacy-techniques.md`.
3. **What are we going to do about it?** Mitigate. Per-letter mitigations plus risk strategies. See `references/mitigations.md`, `references/risk-and-tradeoffs.md`.
4. **Did we do a good job?** Validate. Test the mitigations; QA the threat model itself. See `references/processing-and-validation.md`.

Use these as the structure of any threat-modelling output. A complete deliverable answers all four — anything less is incomplete.

## DFDs and trust boundaries — universally applicable

Threat modelling almost always starts with drawing a system. The standard notation is a **Data Flow Diagram (DFD)** with five element types and one critical addition:

- **External entities** (rectangle) — users, other systems outside your control.
- **Processes** (circle) — your code running.
- **Data stores** (parallel lines) — files, databases, logs.
- **Data flows** (arrow) — data moving between elements.
- **Trust boundaries** (dotted line) — where principals interact and threats cluster.

**Trust boundaries are the most important element.** Threats cluster where they cross. If you draw nothing else, draw trust boundaries.

Two universal heuristics:
- Every data flow crossing a trust boundary deserves attention.
- A process on one side of a trust boundary should not implicitly trust data from the other side.

For full DFD treatment including notation, element semantics, and per-element STRIDE applicability, see `references/stride.md` §3.

## Choosing a technique — decision tree

| Situation | Start here |
|---|---|
| New to threat modelling; getting a team started | `references/eop-card-deck.md` (Elevation of Privilege card game) + `references/stride.md` |
| Standard system threat-modelling workflow | `references/stride.md` (STRIDE) + `references/processing-and-validation.md` |
| Comparing methodologies / asked "should we use PASTA / hTMM / Trike / VAST / quantitative instead of STRIDE?" | `references/methodology-comparison.md` (PASTA 7 stages, hTMM, Trike methodology, VAST honest assessment, QTMM, FAIR-CAM, decision matrix) |
| Regulated AU financial-services engagement; risk-centric methodology required; threat model must feed business-impact analysis | `references/methodology-comparison.md` §1 (PASTA) + `references/financial-services-regulatory-frame.md` |
| Specific high-value flow needs deep analysis | `references/attack-trees.md` |
| Web app, API, framework-heavy system | `references/attack-libraries.md` (CAPEC 3.9, OWASP Top Ten 2025, ASVS 5.0.0, MASVS 2.1.0 / MASTG 2.0.0 / MASWE 1.0.0, WSTG, Proactive Controls v4) |
| Privacy is central (PII, surveillance concerns, GDPR/APP) | `references/privacy-techniques.md` (Solove, LINDDUN GO 2020/2024, LINDDUN PRO, Contextual Integrity) |
| Privacy is central AND need NIST alignment (CSF 2.0 already in use) | `references/requirements-cookbook.md` §6.5 (NIST Privacy Framework v1.1 IPD, five Core functions verbatim, CSF 2.0 mapping) |
| Operational SOC / blue-team modelling | `references/experimental-approaches.md` (Kill Chains, Threat Genomics, Broad Street) |
| Designing requirements before code exists | `references/requirements-cookbook.md` |
| NIST CSF 2.0 (six functions including Govern), NIST SP 800-53 Rev. 5 / Release 5.2.0, CSA CCM v4.1, PCI-DSS v4.0.1, **NIST Privacy Framework v1.1 (IPD; five Core functions with -P suffix)** | `references/requirements-cookbook.md` §6 |
| Choosing risk-handling strategy for a found threat | `references/risk-and-tradeoffs.md` |
| Need an attacker list / persona | `references/attackers-and-assets.md` |
| Modern adversary catalogues — MITRE ATT&CK Groups, Mandiant UNC, CrowdStrike (Bear/Panda/Spider), Microsoft Storm-/Sea- naming | `references/attackers-and-assets.md` §10.5 |
| Web, cloud, or mobile system | `references/domain-web-cloud.md` |
| Login, account, identity, or recovery flow | `references/domain-accounts-identity.md` |
| Passkeys, WebAuthn, FIDO2 (consumer phishing-resistant auth) | `references/domain-accounts-identity.md` §2.6 |
| Anything human-in-the-loop (warnings, scams, ceremonies) | `references/domain-human-factors.md` |
| Dark patterns, consent fatigue, deceptive design | `references/domain-human-factors.md` §8.3 |
| Cryptosystem design or review | `references/domain-cryptosystems.md` |
| Post-quantum cryptography / PQC migration (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA) | `references/domain-cryptosystems.md` §7 |
| Selling threat modelling to your organisation | `references/organisational-adoption.md` |
| Threat-modelling session is producing nothing / dragging | `references/architecting-for-success.md` |
| Validating an existing threat model | `references/processing-and-validation.md` |
| Looking up a term | `references/glossary.md` |
| Want a worked example | `references/case-studies.md` |
| **AI/ML — first time threat-modelling an AI system** | **`references/ai-ml-overview.md`** (start here, then route into the others) |
| **AI/ML — adversarial-ML attacks (evasion, poisoning, extraction, inversion, membership inference)** | **`references/adversarial-ml-attacks.md`** |
| **AI/ML — LLM-integrated app, RAG, chatbot, copilot** | **`references/llm-and-generative-ai-threats.md`** (OWASP LLM Top 10 2026) |
| **AI/ML — AI agent that calls tools, browses, sends email, files tickets** | **`references/agentic-ai-threats.md`** (OWASP ASI Top 10 2026) |
| **AI/ML — ATT&CK-style adversary catalogue for AI** | **`references/mitre-atlas.md`** |
| **AI/ML — STRIDE across the data/training/deployment pipeline** | **`references/ai-pipeline-threats.md`** |
| **AI/ML — choosing defences for an identified AI threat** | **`references/ai-mitigations.md`** |
| **AI/ML — privacy (differential privacy, federated learning, training-data extraction defences, PLOT4AI)** | **`references/ai-privacy-techniques.md`** |
| **AI/ML — governance, regulatory, NIST AI RMF, EU AI Act (Digital Omnibus dates), Australian Voluntary AI Safety Standard / Guidance for AI Adoption, ISO 42001** | **`references/ai-governance-and-requirements.md`** |
| **AI/ML — worked example** | **`references/ai-case-studies.md`** |
| **Cloud-native — first time threat-modelling a Kubernetes / serverless / multi-cloud system** | **`references/cloud-native-overview.md`** (start here, then route into the others) |
| **Cloud-native — adversary lens (MITRE ATT&CK for Cloud and Containers)** | **`references/mitre-attack-cloud-and-containers.md`** |
| **Cloud-native — Kubernetes-specific (RBAC, etcd, kubelet, admission, pod security)** | **`references/kubernetes-threats.md`** |
| **Cloud-native — container/image supply chain, SLSA, Sigstore, SBOM** | **`references/container-supply-chain.md`** |
| **Cloud-native — Lambda / Cloud Functions / Azure Functions / event-driven; WebAssembly at the edge (Cloudflare Workers, Fastly Compute, Fermyon Spin, WasmEdge, Wasmtime); capability sandbox vs container** | **`references/serverless-and-event-driven.md`** (Wasm in §11) |
| **CI/CD — first time threat-modelling a pipeline as production infrastructure** | **`references/cicd-overview.md`** (start here, then route into the others) |
| **CI/CD — source-control / Git platform threats (branch protection, PR abuse, signed commits, Dependabot/Renovate, fork-PR token leaks)** | **`references/source-control-threats.md`** |
| **CI/CD — build environment threats (runners, OIDC trust policies, secrets in env/logs, cache poisoning, third-party Actions)** | **`references/build-environment-threats.md`** |
| **CI/CD — dependency confusion, typosquatting, lockfile manipulation, ecosystem-specific patterns** | **`references/dependency-and-registry-threats.md`** |
| **CI/CD — IaC misconfiguration, state files, policy-as-code bypass (Terraform / CFN / Pulumi / Bicep / Crossplane)** | **`references/iac-threats.md`** |
| **CI/CD — GitOps (ArgoCD, Flux, sealed-secrets, SOPS, app-of-apps, manifest source-repo compromise)** | **`references/gitops-threats.md`** |
| **CI/CD — frameworks reference (SLSA, in-toto, Sigstore, SBOM, NIST SSDF, OpenSSF Scorecard, OWASP CI/CD Top 10 verbatim)** | **`references/supply-chain-frameworks.md`** |
| **CI/CD — worked incident analysis (SolarWinds, CodeCov, Heroku/Travis, Ledger Connect Kit, XZ Utils, tj-actions/changed-files, typosquatting campaigns, Cyberhaven 2024)** | **`references/cicd-case-studies.md`** |
| **Browser extension threat modelling; Manifest V3 architecture; extension store as trust boundary; enterprise allow-listing; Cyberhaven 2024 worked example** | **`references/dependency-and-registry-threats.md`** §11 + **`references/cicd-case-studies.md`** §8 |
| **CI/CD — defence-in-depth controls (branch protection, OIDC, ephemeral runners, signing, attestation, egress allow-listing, drift detection)** | **`references/cicd-mitigations.md`** |
| **Cloud-native — cloud IAM, workload identity, IMDS, federated identity, token theft** | **`references/cloud-iam-and-identity.md`** |
| **Cloud-native — storage, KMS, VPC, service mesh, API gateway, WAF, DNS** | **`references/cloud-data-network-mesh.md`** |
| **Cloud-native — choosing defences (Zero Trust, OPA, Kyverno, Falco, Tetragon, signing, secrets)** | **`references/cloud-native-mitigations.md`** |
| **Cloud-native — real incidents to learn from (Capital One, SolarWinds, CodeCov, Log4Shell, Storm-0558, XZ Utils, Snowflake, Medibank)** | **`references/cloud-incident-case-studies.md`** |
| **API security — first time threat-modelling a REST / GraphQL API, OAuth flow, or webhook** | **`references/api-security-overview.md`** (start here, then route into the others) |
| **API security — OWASP API Security Top 10 2023 verbatim and STRIDE/AINCAA mappings** | **`references/owasp-api-top10.md`** |
| **API security — OAuth 2.0 / OIDC flow review; JWT, PKCE, DPoP, mTLS-bound tokens, refresh-token rotation (RFC 6819 / 9700 / 8725 / 10017)** | **`references/oauth2-and-oidc-threats.md`** |
| **API security — GraphQL endpoint (depth, complexity, alias, batch, introspection, field-level authz, persisted queries, Apollo/Hasura federation)** | **`references/graphql-threats.md`** |
| **API security — REST endpoint design (BOLA, BFLA, mass assignment, SSRF, parameter pollution, content-type confusion, request smuggling)** | **`references/rest-api-design-threats.md`** |
| **API security — webhooks inbound (signature verification, replay, idempotency, Standard Webhooks) and outbound (SSRF, allow-listing, retries)** | **`references/webhook-security.md`** |
| **API security — multi-tenant SaaS, B2B partner API ecosystem, per-partner credential design, partner-compromise blast radius, tenant isolation** | **`references/multi-tenant-and-partner-api-threats.md`** |
| **API security — consolidated mitigations (auth strategy, authz patterns, schema validation, rate limiting, gateway, runtime API protection, contract testing)** | **`references/api-mitigations.md`** |
| **API security — worked breach incidents (T-Mobile, Twitter, Optus, Latitude, Coinbase, USPS, Peloton, Facebook View As)** | **`references/api-case-studies.md`** |
| **Sprint-pace TM — fast-moving project with a deadline; need a minimum-viable threat model; 60-minute / 4-hour / 1-day patterns** | **`references/time-pressured-threat-modelling.md`** |
| **Sprint-pace TM — multi-squad coordination; seam reviews; system-level threat-model-of-threat-models; shared trust boundaries** | **`references/multi-squad-coordination.md`** |
| **Sprint-pace TM — project kickoff toolkit; first-cut DFD; pre-mortem; engagement model; first-week checklist** | **`references/kickoff-and-first-week-deliverables.md`** |
| **Sprint-pace TM — continuous TM in delivery; CTM cadence; ADRs; TM-as-code (pytm, Threagile, IriusRisk); security-champion model** | **`references/continuous-threat-modelling.md`** |
| **Sprint-pace TM — negotiating with PMs and squad leads; non-negotiables; risk-acceptance forms; escalation; disagree-and-commit** | **`references/security-risk-negotiation.md`** |
| **Sprint-pace TM — Threat Modeling Manifesto verbatim; OWASP SAMM v2 levels; BSIMM16 AM activities (Black Duck, Feb 2026); Microsoft SDL; planning the maturity arc** | **`references/threat-modelling-manifesto-and-maturity.md`** |
| **AU regulatory — Privacy Act 1988; 13 APPs verbatim; NDB scheme; 2024 amendments (tiered penalties, statutory tort, ADM transparency); CDR; IVS Act 2023** | **`references/australian-privacy-landscape.md`** |
| **AU regulatory — financial-services frame; APRA CPS 234 (in force), CPS 230 (in force from 1 July 2025), CPS 231 (superseded by CPS 230); NCCP / RG 209 responsible lending; AUSTRAC AML/CTF; ASIC ePayments Code** | **`references/financial-services-regulatory-frame.md`** |
| **AU regulatory — identity-document handling; DVS, FVS, Digital ID, IVS Act 2023; verify-and-discard; per-state DL format; post-Optus / Latitude data toxicity** | **`references/identity-document-handling.md`** |
| **AU regulatory — consequential AI; 8 AI Ethics Principles verbatim; Voluntary AI Safety Standard 10 guardrails verbatim; Guidance for AI Adoption six practices (mandatory guardrails not proceeding); ADM transparency; EU AI Act overlay; APRA model risk** | **`references/regulated-ai-decisioning.md`** |
| **AU regulatory — vendor and third-party data sharing; APP 8 cross-border; CPS 230 material service provider; processing agreements; Modern Slavery; SOCI Act; Cyber Security Act 2024; sovereign cloud / data residency** | **`references/vendor-data-sharing-threats.md`** (Cyber Security Act in §10.3; sovereign cloud in §13) |
| **AU regulatory — OAIC Privacy Impact Assessment process; 10 steps verbatim; PIA vs privacy threat model; PIA outputs as design-time inputs** | **`references/oaic-pia-process.md`** |
| **AU regulatory — worked incidents (Optus 2022, Medibank 2022, Latitude 2023, HWL Ebsworth 2023, MediSecure 2024, Service NSW 2020)** | **`references/au-regulated-industry-case-studies.md`** |
| **OT / ICS / IoT — first time threat-modelling a plant, refinery, water utility, substation, building automation, IoT fleet** | **`references/ot-ics-iot-threats.md`** (Purdue, IEC 62443 zones/conduits, ATT&CK for ICS 12 tactics, NIST 800-82r3, safety-override property, IoT-at-scale, AU SOCI/CIRMP) |
| **OT — IEC 62443 zones and conduits; four Security Levels (SL 1–4); SL-T mismatch analysis** | **`references/ot-ics-iot-threats.md`** §3 |
| **OT — Purdue Reference Model; Level 3.5 industrial DMZ; IT/OT boundary** | **`references/ot-ics-iot-threats.md`** §2 |
| **OT — MITRE ATT&CK for ICS 12 tactics verbatim (incl. Inhibit Response Function TA0107, Impair Process Control TA0106)** | **`references/ot-ics-iot-threats.md`** §4 |
| **OT — NIST SP 800-82 Rev. 3 (Sept 2023); OT overlay for SP 800-53 Rev. 5** | **`references/ot-ics-iot-threats.md`** §5 |
| **OT — safety-instrumented systems (SIS); IEC 61511 / ANSI ISA-84; safety-override property** | **`references/ot-ics-iot-threats.md`** §6 |
| **IoT — consumer / prosumer IoT at scale; OTA update channel; default credentials; ETSI EN 303 645; OWASP IoT Top 10** | **`references/ot-ics-iot-threats.md`** §7 |
| **AU SOCI Act / CIRMP / 11 critical-infrastructure sectors / AESCSF / energy-sector cyber framework** | **`references/ot-ics-iot-threats.md`** §8 (with cross-references to `vendor-data-sharing-threats.md`) |
| **OT worked incidents — Triton (2017), Industroyer / Industroyer2 (2016, 2022), Pipedream (2022), Colonial Pipeline (2021), Oldsmar water (2021), FrostyGoop (2024)** | **`references/ot-ics-iot-threats.md`** §9 |
| **Confidential computing / TEE / Trusted Execution Environment / cloud-provider in the threat model; data clean rooms (AWS, Snowflake, Decentriq, Ads Data Hub)** | **`references/confidential-computing-and-tees.md`** (trust-boundary shift, Intel TDX / AMD SEV-SNP / Arm CCA / NVIDIA GPU TEE, RFC 9334 RATS, Apple PCC five properties verbatim, confidential AI, TEE.fail and side-channel limitations, **data clean rooms in §10**) |
| **Apple Private Cloud Compute / PCC / non-targetability / verifiable transparency** | **`references/confidential-computing-and-tees.md`** §5 |
| **Remote attestation / RATS / RFC 9334 / Attester / Verifier / Relying Party / Passport vs Background-Check** | **`references/confidential-computing-and-tees.md`** §4 |
| **AWS Nitro Enclaves / KMS attestation condition keys / Azure Confidential VMs / GCP Confidential VMs** | **`references/confidential-computing-and-tees.md`** §3 |
| **Confidential AI / inference inside TEE / H100 + TDX composite attestation / private prompt** | **`references/confidential-computing-and-tees.md`** §6 (with cross-refs to `ai-mitigations.md` and `ai-privacy-techniques.md`) |
| **TEE.fail / SGXPectre / Foreshadow / Downfall / ÆPIC Leak / TEE side-channel limitations** | **`references/confidential-computing-and-tees.md`** §7 — read before recommending |
| **Designing hardware / firmware / embedded product; manufacturer scoping EU CRA, UK PSTI, CISA Secure by Design compliance** | **`references/hardware-firmware-embedded.md`** (TPM 2.0, Secure Enclave, TrustZone, Pluton; UEFI Secure Boot, verified boot, measured boot; side-channels; JTAG / glitching / chip-off; firmware supply chain incl. TUF / Uptane / SUIT / HBOM; MITRE EMB3D v2.0; EU CRA Annex I; UK PSTI three requirements; CISA Secure by Design three principles) |
| **EU Cyber Resilience Act (Reg (EU) 2024/2847) / Annex I / 24h vulnerability notification / Class II products** | **`references/hardware-firmware-embedded.md`** §8.1 |
| **UK PSTI Act 2022 / three security requirements / Statement of Compliance** | **`references/hardware-firmware-embedded.md`** §8.2 |
| **MITRE EMB3D v2.0 / hardware-firmware-applications-networking threat categories / Foundational-Intermediate-Leading mitigation tiers** | **`references/hardware-firmware-embedded.md`** §7 |
| **TPM 2.0 / Secure Enclave / TrustZone / Microsoft Pluton / HSM design choice** | **`references/hardware-firmware-embedded.md`** §2 |
| **Secure boot / verified boot / measured boot / chain of trust as DFD pattern** | **`references/hardware-firmware-embedded.md`** §3 |
| **Firmware update — TUF, Uptane, SUIT (RFC 9019), HBOM, NIST SP 800-147 / 800-193** | **`references/hardware-firmware-embedded.md`** §6 |
| **Medical device cybersecurity / SaMD / FDA premarket cybersecurity guidance (Feb 2026) / IEC 62304 / IEC 81001-5-1 / IMDRF / TGA AU SaMD guidance** | **`references/medical-device-cybersecurity.md`** |
| **Automotive cybersecurity / ISO/SAE 21434 / UN R155 CSMS / UN R156 SUMS / TARA / in-vehicle ECU / CAN / V2X / ADAS** | **`references/automotive-cybersecurity.md`** |
| **Using an LLM / AI assistant to do threat modelling; StrideGPT, AWS Threat Composer, Microsoft Security Copilot, IriusRisk AI features; how to use these well without inheriting their failure modes** | **`references/ai-assisted-threat-modelling.md`** |
| **Modern AI red-teaming tooling — PyRIT (Microsoft), Garak (NVIDIA), Promptfoo, NeMo Guardrails, OpenAI Evals** | **`references/ai-mitigations.md`** §10 (refreshed) + **`references/ai-assisted-threat-modelling.md`** §8 |
| **MITRE D3FEND defensive-technique mapping; ATT&CK-to-D3FEND mapping; STRIDE-to-D3FEND crosswalk; D3FEND OT extension** | **`references/d3fend-mitigation-mapping.md`** |
| **VEX / Vulnerability Exploitability eXchange / four status values / CSAF v2.0 / OASIS Standard / SBOM + VEX + CSAF triad** | **`references/supply-chain-frameworks.md`** §§4a-4b |
| **Bridging TM output to detection engineering / Sigma rules / Detection-as-Code (Panther, Sentinel Repositories, Splunk, Chronicle) / Atomic Red Team validation** | **`references/processing-and-validation.md`** §13 |

For most workflows, **read at least `stride.md` and `processing-and-validation.md`**. The other references load as needed.

## Reference index

All files are in `references/` relative to this SKILL.md.

| # | File | Source chapter | What's in it |
|---|---|---|---|
| 1 | `stride.md` | Ch. 3, 8 | STRIDE letters, AINCAA, DFD applicability, STRIDE-per-Element / per-Interaction / DESIST, mitigation summary |
| 2 | `attack-trees.md` | Ch. 4, App B | Tree methodology + all 18 catalogued trees (B-1 to B-15 STRIDE trees plus the four extras) |
| 3 | `attack-libraries.md` | Ch. 5 | CAPEC 3.9 categories, OWASP Top Ten 2025 verbatim, OWASP ASVS 5.0.0, MASVS 2.1.0 / MASTG 2.0.0 / MASWE 1.0.0, WSTG 4.2, Proactive Controls v4 — libraries vs checklists vs literature reviews |
| 4 | `privacy-techniques.md` | Ch. 6, 8 | Solove taxonomy, IETF RFC 6973, PIAs, Nymity Slider, Contextual Integrity, **LINDDUN family (2010 original; GO 2020 / card deck redesigned 2024; PRO process pattern; MAESTRO 2025) with current canonical seven-category list verbatim**, privacy mitigations |
| 5 | `mitigations.md` | Ch. 8 | Full per-STRIDE-letter mitigations, Holly Towle's 10 PII principles, Standard Deployments, traps |
| 6 | `risk-and-tradeoffs.md` | Ch. 9 | Five risk strategies (avoid/address/accept/transfer/ignore), Bug Bar, FAIR, "Fuzzing is not a mitigation", arms races |
| 7 | `processing-and-validation.md` | Ch. 7, 10 | When/where to start, top-down vs bottom-up, three lists to iterate across, mitigation order, Playing Chess, Running from the Bear, threats tables, assumption tracking, External Security Notes, customer-vendor boundary, new tech, 7-step API checklist, validation, model/reality conformance |
| 8 | `requirements-cookbook.md` | Ch. 12 | Business, prevent/detect/respond, people/process/technology, dev vs acquisition, compliance (CSA CCM v4.1; **NIST CSF 2.0 with six functions verbatim incl. Govern**; NIST SP 800-53 Rev. 5 / Release 5.2.0; PCI-DSS v4.0.1; **NIST Privacy Framework v1.1 IPD (14 April 2025) — five Core functions verbatim with -P suffix and CSF 2.0 mapping**), privacy (FIPs, Privacy by Design, Seven Laws of Identity, MPSD), STRIDE requirements by AINCAA, non-requirements with Microsoft's 10 Immutable Laws |
| 9 | `domain-web-cloud.md` | Ch. 13 | Web, browser+plugin, cloud tenant, cloud provider, mobile |
| 10 | `domain-accounts-identity.md` | Ch. 14 | Account life cycle, authentication, account recovery, names/IDs/SSNs — all four read-aloud checklists; **§2.6 Passkeys, WebAuthn, FIDO2** (W3C WebAuthn Level 3 Recommendation, 25 Aug 2026) |
| 11 | `domain-human-factors.md` | Ch. 15 | Three models of people, ceremonies, Ceremony Analysis Heuristics, Stajano-Wilson scam principles, NEAT, SPRUCE, Gold Bar, kind learning environments, scamicry; **§8.3 Dark patterns / consent fatigue** (EU DSA, GDPR Art 7, EDPB Guidelines 03/2022, ACCC, FTC) |
| 12 | `domain-cryptosystems.md` | Ch. 16 | Primitives (basic, privacy, modern), classic actors, attacks, six things to remember, Kerckhoffs; **§7 Post-quantum cryptography and crypto-agility** (FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA — finalised 13 August 2024; NIST IR 8547; CISA PQC; CNSA 2.0) |
| 13 | `organisational-adoption.md` | Ch. 17 | Selling to ICs vs management, who does what, dev lifecycle integration, the three objection families with counters |
| 14 | `experimental-approaches.md` | Ch. 18 | Seams, FlipIT, Kill Chains (LM + Threat Genomics), Broad Street, adversarial ML, business TM, dangerous deliverables and approaches, how to experiment |
| 15 | `architecting-for-success.md` | Ch. 19 | Flow, cognitive load, creator blindness, boundary objects, best vs good, "the threat model has changed", artistry |
| 16 | `attackers-and-assets.md` | App A, C | Network/physical/people/supply-chain/privacy/non-sentient attackers, Internet Threat Model (RFC 3552), asset catalogues, Barnard, Verizon DBIR 2026, OWASP, Intel TARA, **Aucsmith's 8 personas**, **§10.5 Modern adversary catalogues** (MITRE ATT&CK Groups, Mandiant UNC, CrowdStrike adversary naming, Microsoft Storm-/Sea- naming) |
| 17 | `eop-card-deck.md` | App D | Every card in every suit with discussion |
| 18 | `case-studies.md` | App E | Acme Database (by element), Acme Operational Network (by threat), Phones+OTT (by requirement), iNTegrity classroom exercise |
| 19 | `tools-catalogue.md` | Ch. 11 | Whiteboards, office, bug trackers, TRIKE, EoP, ThreatModeler, Corporate Threat Modeller, SecurITree, Little-JIL, MS SDL TM Tool 2016 (long-term maintenance); **modern open-source: OWASP Threat Dragon, pytm, Threagile; current commercial: IriusRisk**; SeaMonster (abandoned); §5 AI-assisted tools (routes to #74) |
| 20 | `glossary.md` | Glossary | Every term defined in the book |
| 20b | `methodology-comparison.md` | UcedaVelez & Morana 2015; CMU/SEI-2018-TN-002 (Mead et al. 2018); octotrike.org; ThreatModeler VAST; FAIR Institute on FAIR-CAM (2021) | **PASTA seven stages verbatim with choose / do-not-choose criteria; hTMM five steps verbatim (Security Cards + STRIDE + PnG synthesis); Trike actor-asset-action methodology (methodology vs unmaintained tool); VAST honest assessment as a vendor label; QTMM (STRIDE + attack trees + CVSS); FAIR-CAM three control categories; decision matrix mapping engagement characteristics to recommended methodology. Hard rule preserved — STRIDE remains the default for new teams.** |
| 71 | `ot-ics-iot-threats.md` | IEC 62443 series (ISA / IEC; 62443-4-2:2026); NIST SP 800-82 Rev. 3 (Sept 2023; Rev. 4 IPD 2026); MITRE ATT&CK for ICS v19.2; ANSI/ISA-95 Purdue model; AU SOCI Act 2018 + CIRMP Rules; AESCSF v2; ETSI EN 303 645; OWASP IoT Top 10; Dragos public reporting | **OT/ICS/IoT extension. Why OT needs its own lens (safety override; deterministic real-time; air-gap-as-myth); Purdue levels 0–4 + 3.5 DMZ; IEC 62443 zones, conduits and four Security Levels paraphrased; MITRE ATT&CK for ICS 12 tactics verbatim with TA IDs (incl. Inhibit Response Function TA0107 and Impair Process Control TA0106); NIST SP 800-82 Rev. 3 OT overlay; STRIDE adaptation with Safety as sixth property; IoT-at-scale (OTA update, default creds, decommissioning); AU SOCI Act 2018 with 11 designated sectors + CIRMP all-hazards framework + AESCSF; worked incidents (Triton, Industroyer / Industroyer2, Pipedream, Colonial Pipeline, Oldsmar, FrostyGoop); four additional OT/IoT universal heuristics.** |
| 72 | `confidential-computing-and-tees.md` | Apple PCC (June 2024); IETF RFC 9334 RATS (Jan 2023); Intel TDX overview; AMD SEV-SNP developer pages; Arm CCA; AWS Nitro Enclaves docs and KMS condition keys; Azure Confidential Computing; Google Confidential Computing; NVIDIA H100 / H200 / B200 confidential compute; Confidential Computing Consortium; TEE.fail paper (2025) | **Confidential computing / TEE extension. Trust-boundary shift (cloud provider outside trust boundary); Intel TDX / AMD SEV-SNP / Arm CCA / NVIDIA GPU TEE comparison matrix; AWS / Azure / GCP confidential offerings including AWS KMS attestation condition keys verbatim; IETF RATS three principal roles (Attester, Verifier, Relying Party) and two topological patterns (Passport, Background-Check); Apple PCC five properties verbatim; confidential AI (H100/B200 + TDX/SEV-SNP composite attestation); honest TEE limitations including TEE.fail 2025 attack, SGX/TDX/SEV-SNP side-channel history, attestation-infrastructure risk, trust-the-vendor problem; when to use and when not.** |
| 73 | `hardware-firmware-embedded.md` | EU Regulation 2024/2847 (CRA; reporting obligations in force 11 Sept 2026); UK PSTI Act 2022 + Regs 2023; CISA Secure by Design joint guidance; MITRE EMB3D v2.0.2 (June 2026); TCG TPM 2.0 Library; NIST SP 800-147 (April 2011); NIST SP 800-193 (May 2018); IETF RFC 9019 SUIT; TUF / Uptane; AU Voluntary Code of Practice for Consumer IoT (2020) | **Device-level hardware / firmware / embedded extension distinct from #71's system level. Hardware roots of trust (TPM 2.0; Apple Secure Enclave; Arm TrustZone A and M; Microsoft Pluton; HSMs); UEFI Secure Boot + verified boot + measured boot chain-of-trust as DFD pattern; side-channel attacks design-time relevance; physical attacks (JTAG, glitching, chip-off, bus interposition); firmware supply chain (NIST 800-147 / 800-193; TUF / Uptane / SUIT; HBOM); MITRE EMB3D v2.0 with four threat categories and three mitigation tiers; EU CRA Annex I and 24h vulnerability reporting; UK PSTI three requirements verbatim; CISA Secure by Design three principles verbatim; AU Voluntary Code; worked smart-camera example.** |
| 76 | `medical-device-cybersecurity.md` | FDA *Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions* (Feb 2026; supersedes June 2025 and Sept 2023 editions); IEC 62304 + Edition 2 in development; IEC 81001-5-1:2021; IMDRF SaMD framework + N81 (Jan 2025); TGA SaMD guidance (Aug 2025); MDIC playbooks; MITRE *Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook* | **Medical device cybersecurity extension. Scope (Class II/III; SaMD; IEC 81001-5-1 health software). FDA premarket cybersecurity guidance required submission components (SBOM; risk management; KEV-catalogue vulnerabilities; security architecture views). IEC 62304 software safety classes A/B/C and Edition 2 two-level transition. IEC 81001-5-1 two security levels and lifecycle activities (incl. mandatory threat modelling at Security Level II). IMDRF SaMD characterisation framework and Jan 2025 N81. TGA SaMD guidance (Aug 2025) with AI/adaptive-algorithm focus and AU privacy overlay. Six medical-device-specific threat classes (workflow disruption; infusion-pump tampering; imaging modality compromise; HL7/FHIR integration; connected-implant remote-access; cybersecurity-driven end-of-support). Worked infusion-pump-fleet TM. Two universal heuristics: patient safety overrides cybersecurity; maintain support for full clinical lifetime.** |
| 77 | `automotive-cybersecurity.md` | ISO/SAE 21434:2021; UN Regulation No. 155 (in force July 2022 for new types, all new vehicles from July 2024); UN Regulation No. 156 (SUMS); SAE J3061 (historical); ENISA *Good practices for the security of smart cars*; Uptane | **Automotive cybersecurity extension. ISO/SAE 21434 lifecycle (concept / product development / cybersecurity validation / operations / decommissioning) with TARA seven-step process (asset / threat scenario / impact (SFOP) / attack path / feasibility / risk / treatment). UN R155 two-tier compliance (organisational CSMS Certificate of Compliance + per-vehicle-type cybersecurity type approval). UN R156 SUMS with Uptane-compatible OTA properties. In-vehicle threat model — ECUs and gateway; CAN/CAN-FD/LIN/FlexRay/Automotive Ethernet (unauthenticated by default); IVI; TCU (highest-value remote target); V2X / C-V2X / DSRC; ADAS sensors. Aftermarket and CSA-supplier supply chain. Worked connected-ECU-with-OTA TM. Two universal heuristics: functional safety (ISO 26262) and cybersecurity are parallel regimes; CSMS is organisational, type approval is per-vehicle.** |
| 74 | `ai-assisted-threat-modelling.md` | StrideGPT (Matt Adams 2023+); AWS Threat Composer (AWS Labs); Microsoft Security Copilot; IriusRisk AI features; Microsoft PyRIT (`microsoft/PyRIT`, v1.1.0 Sept 2026); NVIDIA Garak; Promptfoo (OpenAI-owned since Mar 2026); NVIDIA NeMo Guardrails; OpenAI Evals (hosted platform closing 30 Nov 2026) | **The meta-extension: practitioner-side use of AI in TM workflow. What changed and what stayed the same (the four questions); the AI-assisted TM tools (StrideGPT, AWS Threat Composer, Microsoft Security Copilot, IriusRisk AI, custom workflows); when AI-assisted TM helps and when not; **the meta-risk** of using LLMs to threat-model LLM-integrated systems (the agentic-AI authority pyramid applies to the TM assistant itself); workflow patterns for kickoff / continuous TM / seam reviews; evaluating LLM output against `processing-and-validation.md` §11; modern AI red-teaming toolchain (PyRIT, Garak, Promptfoo, NeMo Guardrails, OpenAI Evals) replacing the Perez 2022 reference in `ai-mitigations.md` §10. Tool currency anchored to retrieval date 2026-09-16.** |
| 75 | `d3fend-mitigation-mapping.md` | MITRE D3FEND v1.6.0 (`d3fend.mitre.org`, 31 Aug 2026; OT extension Dec 2025); D3FEND-CKG; ATT&CK-D3FEND mapping | **Defensive counterpart to ATT&CK. Seven D3FEND tactics verbatim (Model, Harden, Detect, Isolate, Deceive, Evict, Restore); ATT&CK-to-D3FEND mapping workflow; STRIDE-to-D3FEND crosswalk; when to reach for D3FEND and when not. Closes the gap where SKILL.md listed D3FEND in framework state but no reference file used it.** |
| 21 | `ai-ml-overview.md` | AI/ML extension (2025-2026 synthesis) | Four questions applied to AI/ML; STRIDE-adapts-cleanly map; AI-specific elements that don't map; two AI universal heuristics; decision tree into the other AI files |
| 22 | `adversarial-ml-attacks.md` | Biggio, Papernot, Madry, Goodfellow, Carlini, Athalye | Threat-model taxonomy (five dimensions); evasion (FGSM/PGD/C&W/transfer/physical); poisoning (targeted/untargeted/clean-label); backdoors; model extraction; model inversion; membership inference; transferability; obfuscated gradients |
| 23 | `llm-and-generative-ai-threats.md` | OWASP LLM Top 10 2026 (3 Aug 2026); Greshake 2023; Wei 2023; Carlini 2021 | "Prompt is untrusted input"; direct vs indirect prompt injection; jailbreak failure modes (competing objectives, mismatched generalisation); OWASP LLM01–10:2026 verbatim (§§5–14 in 2026 order; 2025→2026 changes noted) with per-entry threats and mitigations; training-data extraction; RAG-specific threats |
| 24 | `agentic-ai-threats.md` | OWASP ASI Top 10 2026; Microsoft Copilot Studio guidance; Anwar et al. 2024 | Authority pyramid (tools, identity, memory, autonomy); ASI01-10 verbatim with per-entry treatment; STRIDE in agentic systems; agent threat-modelling workflow |
| 25 | `mitre-atlas.md` | `atlas.mitre.org` v2026.09 (15 Sept 2026; calendar versioning since v2026.05; monthly cadence) | **16 ATLAS tactics verbatim** with non-sequential AML.TA IDs (AI Model Access AML.TA0000 and AI Attack Adaptation AML.TA0001 — renamed from AI Attack Staging in v2026.08 — are AI-specific; Lateral Movement AML.TA0015 added v5.1.0; Command and Control AML.TA0014 added v4.9.0); notable techniques table; three usage patterns; ATLAS vs OWASP vs NIST comparison |
| 26 | `ai-pipeline-threats.md` | Microsoft AI/ML threat modelling (Marshall et al. 2019); ENISA AI threat landscape | STRIDE applied across 8 pipeline stages (collection, labelling, training, registry, deployment, serving, monitoring, feedback); cross-stage threats; Microsoft's three Key New Considerations |
| 27 | `ai-mitigations.md` | Madry 2018; Abadi 2016; Mitchell 2019; Gebru 2018; Perez 2022; OWASP mitigation sections | Mitigations by attack category and by pipeline stage; adversarial training; tool sandboxing; poisoning defences; provenance artefacts (datasheets, model cards, AIBOM); watermarking; input/output filtering; system-prompt and structural separation; red-teaming; HITL; rate limiting; defences to be sceptical of |
| 28 | `ai-privacy-techniques.md` | Dwork & Roth 2014; Abadi 2016; Kairouz 2021; Carlini 2021; PLOT4AI | Differential privacy fundamentals; data minimisation; defences against membership inference and extraction; federated learning and its privacy concerns; PLOT4AI (138 threats, 8 categories); mapping to Solove and LINDDUN |
| 29 | `ai-governance-and-requirements.md` | NIST AI RMF 1.0; **NIST AI 600-1 (Generative AI Profile, 26 July 2024)**; EU AI Act 2024/1689 as amended by the AI Digital Omnibus 2026/1744; ISO 42001/23894; Australia VAISS + *Guidance for AI Adoption* (Oct 2025); Australia AI Ethics Principles (canonical); OECD AI Principles | NIST 4 functions verbatim; EU AI Act 4 risk tiers verbatim plus phase-in (Annex III high-risk deferred to **2 Dec 2027**, Annex I to 2 Aug 2028; Article 50 live since 2 Aug 2026); ISO outlines; Australia's 10 voluntary guardrails verbatim plus the six *Guidance for AI Adoption* essential practices verbatim (mandatory guardrails not proceeding); Australia's 8 AI Ethics Principles verbatim; OECD's 5 values-based principles verbatim; AI-system requirements pattern; AI non-requirements |
| 30 | `ai-case-studies.md` | Public disclosures synthesised | Five worked examples: Tay (2016) feedback poisoning; Carlini 2021 training-data extraction; Bing Chat / Sydney indirect injection; Slack AI exfiltration; agentic Confluence-reading email-sending assistant |
| 31 | `cloud-native-overview.md` | Cloud-native extension (2026 synthesis) | Control plane vs data plane; new cloud-native trust boundaries; STRIDE adaptations; shared-responsibility line; cloud-native universal heuristics; decision tree into the other cloud-native files |
| 32 | `mitre-attack-cloud-and-containers.md` | `attack.mitre.org` **v19.2 (agile release; v19 28 April 2026)** Cloud + Containers matrices | Full tactic lists verbatim — note **Defense Evasion has been split into Stealth (TA0005) + Defense Impairment (TA0112)** as of v19; major techniques per tactic with IDs; sub-matrices (IaaS, Identity Provider, SaaS, Office Suite); named adversary groups; usage as elicitation lens |
| 33 | `kubernetes-threats.md` | Microsoft Threat Matrix for Kubernetes; OWASP K8s Top Ten 2025 (verbatim); **CIS K8s Benchmark v2.0.1** control families; NIST SP 800-190 | Microsoft K8s threat matrix verbatim; OWASP K01-K10 verbatim; cluster components as DFD elements; RBAC misuse; pod-level threats; NetworkPolicy / admission control / Secrets; cluster-to-cloud lateral movement |
| 34 | `container-supply-chain.md` | NIST SP 800-204D / 800-218 / 800-161; **SLSA v1.2 (Nov 2025; Source Track now stabilised)**; **Sigstore cosign v3.x / Rekor v2 (2025)**; **in-toto v1.0 (CNCF graduated April 2025)**; CISA SCRM; XZ Utils 2024 analyses; CodeCov 2021 post-mortem (`about.codecov.io/security-update/`) | Five elements of the container supply chain; build-time vs run-time; base-image and registry threats; dependency confusion; SLSA Build and Source levels verbatim; Sigstore (cosign, fulcio, rekor); SBOM and attestation; XZ Utils pattern; Dockerfile anti-patterns |
| 35 | `serverless-and-event-driven.md` | AWS / Azure / GCP serverless docs; OWASP Serverless Top 10; NIST SP 800-204 / 800-204A | Event sources as the front door; execution role least privilege; function-event injection; cold-start abuse; layer/extension poisoning; Step Functions / Durable Functions; queue/topic misconfigurations; idempotency / Denial of Wallet |
| 36 | `cicd-overview.md` | NIST SP 800-204D; CISA / NSA *Defending CI/CD Environments* (June 2023); OWASP CI/CD Top 10; SLSA v1.0 | CI/CD as production infrastructure; control plane vs data plane of the pipeline; new trust boundaries (developer→repo, repo→runner, runner→registry, registry→deploy); five high-impact public incidents as anchor; routing into the other CI/CD files; six CI/CD universal heuristics |
| 37 | `source-control-threats.md` | GitHub / GitLab / Bitbucket / Azure DevOps docs; OWASP CICD-SEC-1, -2, -4, -5; Heroku / Travis OAuth 2022; tj-actions 2025 | Git-platform attacks; account and credential compromise; branch protection / ruleset bypass; PR abuse and `pull_request_target` footgun; signed commits / signed tags; force-push and tag mutability; secret scanning / push protection; Dependabot / Renovate as threat surface; fork-PR token leakage; webhook spoofing; repo transfer; SCM audit

…(truncated)