Threat Modeling
Use before or during design of sensitive, exposed, privileged, multi-tenant, payment, identity, file, or data-processing systems.
Workflow
- Define scope, architecture, data flows, assets, actors, dependencies, and deployment environment.
- Mark trust boundaries, entry points, privilege transitions, storage, and third-party calls.
- Enumerate credible abuse cases across identity spoofing, tampering, disclosure, denial, privilege escalation, replay, supply chain, and business logic.
- Rank threats by preconditions, likelihood, impact, detectability, and affected assets.
- Map preventive, detective, and recovery controls; identify owners and validation methods.
- Record assumptions, accepted risk, unresolved questions, and triggers for re-review.
Prefer concrete system-specific attack paths over generic checklist output. Do not perform destructive exploitation or expose sensitive findings publicly.
1---2name: threat-modeling3description: Threat-model a feature or system by mapping assets, actors, trust boundaries, attack paths, mitigations, assumptions, and residual risk.4---56# Threat Modeling78Use before or during design of sensitive, exposed, privileged, multi-tenant, payment, identity, file, or data-processing systems.910## Workflow11121. Define scope, architecture, data flows, assets, actors, dependencies, and deployment environment.132. Mark trust boundaries, entry points, privilege transitions, storage, and third-party calls.143. Enumerate credible abuse cases across identity spoofing, tampering, disclosure, denial, privilege escalation, replay, supply chain, and business logic.154. Rank threats by preconditions, likelihood, impact, detectability, and affected assets.165. Map preventive, detective, and recovery controls; identify owners and validation methods.176. Record assumptions, accepted risk, unresolved questions, and triggers for re-review.1819Prefer concrete system-specific attack paths over generic checklist output. Do not perform destructive exploitation or expose sensitive findings publicly.
egeetas