PŻ.
    Ask the SI

    Threat modeling

    Threat modeling is a design conversation with a written output. Done well it takes hours and removes whole classes of vulnerability before code exists.

    Updated

    Method

    1. 01Diagram

      Data-flow diagram at the level of components and trust boundaries — not class diagrams.

    2. 02Enumerate

      STRIDE per element, written as falsifiable statements: 'an attacker with X can do Y because Z'.

    3. 03Prioritise

      Rank by exploitability and impact; discard the theoretical.

    4. 04Mitigate

      Each accepted threat becomes a backlog item with an acceptance test.

    5. 05Revisit

      Re-open the model when the architecture, data classification or threat landscape changes.

    1Internet edge

    • Public endpoints
    • WAF / CDN
    • DDoS protection

    2Identity plane

    • Entra ID
    • Conditional Access
    • PIM elevation

    3Workload zones

    • Prod subscription
    • Non-prod subscription
    • Shared services

    4Data plane

    • Encrypted stores
    • Key management
    • Private endpoints
    Identifying trust boundaries

    STRIDE remains the most widely used entry point because it is mechanical: six categories, applied to every element of the diagram, beat threat lists assembled by feel. For systems with personal-data flows I add LINDDUN's privacy-specific categories alongside it rather than in place of it; STRIDE and privacy threats answer different questions about the same data flow.

    Frequently asked questions

    STRIDE or attack trees?

    STRIDE for breadth during design, attack trees when you need depth on one high-value scenario.

    Does the method change for AI systems?

    The four questions from the Threat Modeling Manifesto still hold: what are we working on, what can go wrong, what are we going to do about it, did we do a good enough job. For AI and agentic systems I layer in MITRE ATLAS and the OWASP threat taxonomies for LLM and agentic risk rather than replacing STRIDE outright.

    Related

    Threat modeling

    Facilitated STRIDE threat modeling on your real architecture, plus the templates and coaching to keep teams doing it without me.

    STRIDE for AI systems

    Applying STRIDE to LLM and agentic applications: what each category means when untrusted text can act as instructions, where STRIDE stops covering multi-agent failure modes, and the controls per element.

    AI security

    How to secure GenAI, LLM and agentic AI systems: current OWASP threat classes, layered controls, agent authority, retrieval isolation and monitoring.

    From Threat Modeling to a General Principle

    Thoughts on threat modeling

    Confidence

    Recorded CONFidence talk: threat modeling at the scale of Allegro, from STRIDE to a process engineering teams actually run.

    4Developers

    Speaking at 4Developers, a large Polish conference for software engineers, on secure design and AI security.