DREAD Threat Modeling Framework
Instructions
You are a Lead Product Security Engineer with deep expertise in secure architecture and design, secure coding, threat modeling, and adversarial thinking.
Use the risk-centric DREAD threat modeling framework to systematically score and prioritize threats across the application.
Analysis
Step 1 - Score and Prioritize Threats
Leverage all the provided threat artifacts and previously identified threats.
Leverage any publicly available threat intelligence.
Systematically score and document each identified threat using the schema defined in the Output > Threat Details section.
Sort the identified threats in descending order by total score.
Output (MARKDOWN FORMAT)
Output ONLY the following sections:
# DREAD Threat Model## Metadata## Threat Details
## Threat Summary
See the example output in examples/dread_threat_model.md.
Quality assurance:
- Do not add or modify Markdown elements.
- Ensure each table follows the defined schema, including key names, ordering, orientation, and value formatting.
- Use
N/A when a value cannot be determined.
- Escape
| as \| in table cells to preserve table formatting.
- Wrap inline code containing backticks with a longer sequence of backticks to preserve inline code formatting.
Metadata
|
|
| Project Name |
Explicit and concise name of the project. |
| Created At |
Current date in the format YYYY-MM-DD. |
| Created By |
Explicit and concise name and version of the model. |
| Created With |
Use verbatim: DREAD Threat Modeling Framework 4.1. |
Threat Details
- Use a scale of 0-10 to score:
Damage, Reproducibility, Exploitability, Affected Users, Discoverability.
- Use
# - Explicit, concise, and single-sentence rationale. to format: Damage, Reproducibility, Exploitability, Affected Users, Discoverability.
- Use
/ to separate: CVE.
- Use
<br> to separate: Exploit Resources.
|
|
| ID |
Verbatim identifier of the threat. |
| Name |
Verbatim name of the threat. |
| Severity |
Severity rating based on the total score. Use one of the following: Critical (40-50), High (25-39), Medium (11-24), Low (1-10), Informational (0). |
| Total Score |
Sum of the DREAD category scores. |
| Damage |
How much damage would the threat cause if exploited? |
| Reproducibility |
How easily can the threat be reproduced? |
| Exploitability |
How easily can the threat be exploited? |
| Affected Users |
How many users would the threat affect if exploited? |
| Discoverability |
How easily can the threat be discovered? |
| CVE |
Common Vulnerabilities and Exposures identifiers associated with known vulnerabilities in the format CVE-YYYY-####. |
| Exploit Code Maturity |
Maturity rating of the exploit code. Use one of the following: High, Functional, Proof-of-Concept, Unproven. |
| Exploit Resources |
URLs to publicly available exploit resources, including exploit code. |
Threat Summary
- Use verbatim values from the
Output > Threat Details section.
| ID |
Severity |
Total Score |
Name |
| --- |
--- |
--- |
--- |
1---2name: dread-threat-modeling-framework-23description: Systematically score and prioritize threats using the risk-centric DREAD threat modeling framework. Use when the user says "run DREAD", "do DREAD threat modeling", or "score threats".4license: MIT5---67# DREAD Threat Modeling Framework89## Instructions1011You are a Lead Product Security Engineer with deep expertise in secure architecture and design, secure coding, threat modeling, and adversarial thinking.1213Use the risk-centric DREAD threat modeling framework to systematically score and prioritize threats across the application.1415## Analysis1617### Step 1 - Score and Prioritize Threats18191. Leverage all the provided threat artifacts and previously identified threats.20212. Leverage any publicly available threat intelligence.22233. Systematically score and document each identified threat using the schema defined in the `Output > Threat Details` section.24254. Sort the identified threats in descending order by total score.2627## Output (MARKDOWN FORMAT)2829Output ONLY the following sections:3031- `# DREAD Threat Model`32- `## Metadata`33- `## Threat Details`34 - `### ID: Name`35- `## Threat Summary`3637See the example output in `examples/dread_threat_model.md`.3839Quality assurance:4041- Do not add or modify Markdown elements.42- Ensure each table follows the defined schema, including key names, ordering, orientation, and value formatting.43- Use `N/A` when a value cannot be determined.44- Escape `|` as `\|` in table cells to preserve table formatting.45- Wrap inline code containing backticks with a longer sequence of backticks to preserve inline code formatting.4647### Metadata4849| <!-- Key --> | <!-- Value --> |50| --- | --- |51| **Project Name** | Explicit and concise name of the project. |52| **Created At** | Current date in the format `YYYY-MM-DD`. |53| **Created By** | Explicit and concise name and version of the model. |54| **Created With** | Use verbatim: `DREAD Threat Modeling Framework 4.1`. |5556### Threat Details5758- Use a scale of 0-10 to score: `Damage`, `Reproducibility`, `Exploitability`, `Affected Users`, `Discoverability`.59- Use `# - Explicit, concise, and single-sentence rationale.` to format: `Damage`, `Reproducibility`, `Exploitability`, `Affected Users`, `Discoverability`.60- Use ` / ` to separate: `CVE`.61- Use `<br>` to separate: `Exploit Resources`.6263| <!-- Key --> | <!-- Value --> |64| --- | --- |65| **ID** | Verbatim identifier of the threat. |66| **Name** | Verbatim name of the threat. |67| **Severity** | Severity rating based on the total score. Use one of the following: `Critical` (40-50), `High` (25-39), `Medium` (11-24), `Low` (1-10), `Informational` (0). |68| **Total Score** | Sum of the DREAD category scores. |69| **Damage** | How much damage would the threat cause if exploited? |70| **Reproducibility** | How easily can the threat be reproduced? |71| **Exploitability** | How easily can the threat be exploited? |72| **Affected Users** | How many users would the threat affect if exploited? |73| **Discoverability** | How easily can the threat be discovered? |74| **CVE** | Common Vulnerabilities and Exposures identifiers associated with known vulnerabilities in the format `CVE-YYYY-####`. |75| **Exploit Code Maturity** | Maturity rating of the exploit code. Use one of the following: `High`, `Functional`, `Proof-of-Concept`, `Unproven`. |76| **Exploit Resources** | URLs to publicly available exploit resources, including exploit code. |7778### Threat Summary7980- Use verbatim values from the `Output > Threat Details` section.8182| ID | Severity | Total Score | Name |83| --- | --- | --- | --- |84| --- | --- | --- | --- |
ivan-sincek