Threat modeling is the practice of analyzing a system to find what could go wrong with its security and privacy. The Threat Modeling Manifesto defines it as analyzing representations of a system to highlight concerns about security and privacy characteristics. The aim is to decide what to do about those concerns and to check the work was good enough.
- Also Called2other namesthreat modeling · system threat modeling
- Related Terms3linked entriesAttack surface · MITRE ATT&CK
What Is Threat Modeling?
Threat modeling is a way to think through how a system could be attacked, before it is attacked. The Threat Modeling Manifesto defines it as analyzing representations of a system to highlight concerns about security and privacy characteristics.
OWASP describes the work as identifying, communicating and understanding threats and mitigations within the context of protecting something of value. A mitigation is a step that reduces the effect of a threat.
OWASP says a threat model typically holds five things. These are a description of the subject, assumptions that can be challenged later and potential threats. They also include actions to mitigate each threat and a way to validate the model.
How Do You Run a Threat Model?
OWASP and the Threat Modeling Manifesto organize the work around four questions.
- What are we working on?
- What can go wrong?
- What are we going to do about it?
- Did we do a good enough job?
OWASP turns them into steps with named methods.
- Assess scopeDecide what you are working on. It can be as small as a sprint or as large as a whole system.
- Find what can go wrongBrainstorm, or use a structured method such as STRIDE, kill chains or attack trees.
- Choose a responseFor each threat, add a mitigation, or accept, transfer or eliminate the risk.
- Check your workAsk whether the result is good enough for the system at hand.
- Update the modelRevisit it after a new feature, a security incident or an architecture or infrastructure change.
What Does a Small Threat Model Look Like?
A team draws a diagram of an application and the data it handles. For each part of the diagram, the team asks what could go wrong. It then writes down a countermeasure for each concern and later checks whether the countermeasures were enough.
What Principles Guide Good Threat Modeling?
The Threat Modeling Manifesto lists values. It prefers a culture of finding and fixing design issues over checkbox compliance. It prefers people and collaboration over processes, methodologies and tools. It prefers continuous refinement over a single delivery, and doing threat modeling over talking about it.
Its principles include using threat modeling early and often to improve system security and privacy. They also say it should fit the way an organization builds systems and should give value to stakeholders. The manifesto adds that dialogue builds understanding, while documentation records it and makes it measurable.
What Is Data-Centric Threat Modeling?
NIST Special Publication 800-154 is a draft guide on data-centric system threat modeling. NIST describes it as threat modeling that is focused on protecting particular types of data within systems. NIST says organizations can use it as part of their risk management processes. NIST says the approach models both the attack and the defense sides of protecting data. It is meant to set out basic principles for sound methods, not to replace existing methods.
Is Threat Modeling the Same as a Penetration Test?
No. The manifesto defines threat modeling as analyzing representations of a system. A penetration test is a separate practice with its own entry. Related terms on this site include attack surface, tactics, techniques and procedures, and MITRE ATT&CK.
Is Threat Modeling Done Once?
The Threat Modeling Manifesto values a journey of understanding over a single snapshot, and continuous refinement over a single delivery. It describes threat modeling as something to do early and frequently.
Who Takes Part in Threat Modeling?
The manifesto puts people and collaboration over processes, methodologies and tools. Its principles say that dialog establishes shared understanding. They also say outcomes are meaningful when they provide value to stakeholders.
Related Pages in the Knowledge Hub
Also Called.
- Namethreat modeling
- Namesystem threat modeling
Questions.
-
What is threat modeling?
Threat modeling is a way to think through how a system could be attacked, before it is attacked. The Threat Modeling Manifesto defines it as analyzing representations of a system to highlight concerns about security and privacy characteristics.
-
What are the four questions of threat modeling?
OWASP and the Threat Modeling Manifesto organize the work around four questions: what are we working on, what can go wrong, what are we going to do about it, and did we do a good enough job.
-
Is threat modeling the same as a penetration test?
No. The manifesto defines threat modeling as analyzing representations of a system to find security and privacy concerns. A penetration test is a separate practice with its own entry in the glossary on this site.
-
Is threat modeling done once?
No. The Threat Modeling Manifesto values continuous refinement over a single delivery and a journey of understanding over a single snapshot. It describes threat modeling as something to do early and frequently.
Sources
In Our Research
- 1 NIST CSF 2.0: the six functions explained October 2026
- 2 Digital Twins: The Virtual Powerhouses Reshaping Cybersecurity June 2025
- 3 Prompt Injection Attacks: A New Challenge in AI Security June 2025
- 4 Strengthening Data Privacy in Mobile Applications: A Comprehensive Approach March 2025
- 5 Cracking the Code: How Cyber Threat Intelligence Could Save Your Business October 2024
- 6 Building a Secure Foundation: Cybersecurity for Developers June 2024