What is Threat Modelling?
Threat Modelling is a structured cybersecurity practice used to identify, analyse, prioritise, and mitigate potential threats to applications, systems, networks, cloud environments, and business processes. It helps security and development teams understand how a threat actor could exploit vulnerabilities, what attack vectors could be used, and which threat mitigations should be implemented.
Unlike a vulnerability assessment or penetration testing, threat modelling is primarily proactive. It can be performed during the design and development stages to identify security weaknesses before they become exploitable, and it should be revisited as systems, architectures, dependencies, and the threat landscape change.
Threat modelling is also known as risk modelling, threat mapping, threat analysis, attack modelling, adversarial modelling, attack surface analysis, cyber threat assessment, threat exposure analysis, security risk assessment, and security threat assessment.
Synonyms
- Risk Modeling
- Threat Mapping
- Threat Analysis
- Attack Modeling
- Adversarial Modeling
- Attack Surface Analysis
- Cyber Threat Assessment
- Threat Exposure Analysis
- Security Risk Assessment
- Security Threat Assessment
Why Is Threat Modelling Important?
Modern enterprise environments span applications, cloud infrastructure, endpoints, networks, IoT devices, operational technology, third-party services, and distributed data. Each component can introduce vulnerabilities and potential attack paths.
A structured threat modelling framework gives security teams a repeatable way to understand these risks before they become security incidents. It can help organisations:
- Identify potential threats, vulnerabilities, and attack vectors early
- Map how a threat actor could move through a system or application
- Prioritize threats based on likelihood, impact, exploitability, and business risk
- Define appropriate threat mitigations and remediation actions
- Improve application security and secure-by-design practices
- Strengthen enterprise security and risk management
- Support incident response preparedness
- Give incident response teams greater context around likely attack scenarios
- Adapt security controls as the cyber threat landscape changes
Threat modelling is particularly valuable for complex environments where traditional vulnerability-focused approaches may not provide enough context about how individual weaknesses could combine into a viable attack path.
How Does Threat Modelling Work?
The threat modelling process varies according to the environment, business requirements, and chosen threat modelling method. However, most approaches follow a common structure.
1. Define the System and Scope:
Start by identifying what is being modelled. This could be an application, network, cloud workload, IoT device, OT environment, business process, or an entire system. Document key assets, users, data flows, integrations, dependencies, entry points, trust boundaries, and security requirements.
2. Identify Potential Threats:
Determine what could go wrong and how a threat actor could exploit the environment. Teams examine potential attack vectors, threat events, vulnerabilities, privilege boundaries, exposed interfaces, and possible paths to sensitive assets. Threat intelligence can add context by showing relevant threat actors, attack techniques, threat patterns, and emerging cyber threats.
3. Analyze and Prioritize Risks:
Not every potential threat represents the same level of risk. Threat assessment involves evaluating the likelihood and potential impact of different scenarios. Teams can then prioritize threats according to business impact, exploitability, exposure, asset criticality, and existing controls.
4. Define Threat Mitigations:
For prioritized threats, teams determine which security controls or architectural changes can reduce the risk. Mitigations may include stronger authentication, encryption, network segmentation, access controls, secure configurations, monitoring, or application changes.
5. Validate and Continuously Update:
Threat modelling is not a one-time exercise. Security teams should validate whether mitigations work and update the threat model when applications, infrastructure, dependencies, attack surfaces, or the broader threat landscape changes.
Common Threat Modeling Frameworks and Methods
Different threat modeling frameworks provide different ways to structure threat analysis and threat prioritization.
| Framework | What It Does |
| STRIDE | Identifies six categories of threats: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. |
| PASTA | Process for Attack Simulation and Threat Analysis. It uses a risk-centric, attacker-focused approach across seven stages. |
| VAST | Visual, Agile, and Simple Threat modelling methodology designed to scale across applications and infrastructure. |
| TRIKE | A security auditing framework that focuses on risk management and assigning requirements to assets and actions. |
| LINDDUN | Focuses on privacy threats including linkability, identifiability, detectability, disclosure, and non-compliance. |
| SQUARE | Security Quality Requirements Engineering, which helps identify security requirements early in the development lifecycle. |
| Persona Non Grata | Uses attacker personas to model adversarial goals, capabilities, motivations, and behaviours. |
No single threat modeling strategy is suitable for every environment. Organisations may select one framework or combine approaches based on their applications, infrastructure, regulatory requirements, and security objectives.
Threat Modelling vs. Threat Detection
Threat modelling helps organizations anticipate potential threats and understand how attacks could occur. Threat detection identifies suspicious or malicious activity that is actually occurring within an environment.
This makes threat modelling a proactive security planning activity, while threat detection is an operational capability used to identify threats as they emerge.
Threat modelling can also inform detection strategies by helping security teams understand which attack paths, threat patterns, and behaviours require monitoring.
Threat Modelling and NetWitness
Threat modelling helps organizations anticipate where attacks could occur. NetWitness helps security teams investigate and respond when suspicious activity appears across the environment.
NetWitness provides visibility across network, endpoint, and log data to help security teams investigate cyber threats, identify attacker activity, and understand what happened during an incident. This visibility can complement a threat modelling strategy by helping teams validate whether anticipated attack paths or threat patterns are appearing in real-world activity.
For security teams, the combination of proactive threat identification and continuous threat detection can strengthen enterprise security, threat management, and incident response preparedness.
Related Terms & Synonyms
- Risk Modeling: The process of analysing potential risks, their likelihood, and their potential impact to support security decision-making.
- Threat Mapping: The process of visually or systematically mapping threats, attack paths, assets, and vulnerabilities within an environment.
- Threat Analysis: The process of examining potential threats, threat actors, attack methods, and vulnerabilities to understand security risks.
- Attack Modeling: The process of modelling how attackers could exploit vulnerabilities and use different attack paths to compromise systems or data.
- Adversarial Modeling: The process of analysing potential attacker behaviours, objectives, capabilities, and tactics to anticipate security threats.
- Attack Surface Analysis: The process of identifying and evaluating the systems, applications, devices, and entry points that attackers could target.
- Cyber Threat Assessment: The process of evaluating cyber threats based on factors such as likelihood, impact, threat actor capability, and organisational exposure.
- Threat Exposure Analysis: The process of identifying how exposed an organisation’s assets, systems, applications, and data are to potential threats and attack vectors.
- Security Risk Assessment: The systematic evaluation of security risks to determine their likelihood, potential impact, and appropriate risk mitigation measures.
- Security Threat Assessment: The process of identifying, analysing, and prioritising threats that could compromise an organisation’s systems, data, applications, or operations.
People Also Ask
1. What is threat management?
Threat management is the broader practice of identifying, assessing, prioritising, monitoring, mitigating, and responding to security threats. A threat management system can combine threat intelligence, threat detection, vulnerability information, security controls, and incident response capabilities to manage cyber risk throughout its lifecycle.
2. What is the purpose of threat modeling?
The purpose of threat modelling is to identify potential threats and attack paths before they result in a security incident. It helps teams understand vulnerabilities, prioritise risks, and implement appropriate threat mitigations during system design and throughout the system lifecycle.
3. How to perform threat modeling?
A typical threat modelling process involves defining the system and scope, mapping assets and data flows, identifying potential threats and attack vectors, analysing and prioritising risks, defining mitigations, validating controls, and continuously updating the model as the environment changes.
4. What is STRIDE threat model?
STRIDE is a threat modelling methodology developed at Microsoft. It categorizes threats into six areas: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. It provides a structured way to identify common security threats across an application’s architecture.
5. What's the difference between threat modeling and a vulnerability assessment?
Threat modelling is a proactive process that evaluates how systems could be attacked and what could go wrong. A vulnerability assessment primarily identifies and evaluates known vulnerabilities in systems, applications, or infrastructure. Threat modelling focuses on attack scenarios, architecture, assets, and mitigations, while vulnerability assessments typically focus on weaknesses and their severity.
6. What's the difference between threat modeling and penetration testing?
Threat modelling anticipates potential attack paths and security weaknesses, often before or during system development. Penetration testing involves actively attempting to exploit vulnerabilities in a system to determine whether they can be compromised. The two practices complement each other: threat modelling helps determine what could go wrong, while penetration testing helps validate whether specific weaknesses can actually be exploited.
7. What's the difference between threat modeling and risk assessment?
Threat modelling focuses on how threat actors could exploit a system, application, or architecture and what mitigations can reduce those risks. Risk assessment is broader and evaluates risks based on factors such as likelihood, impact, business objectives, compliance requirements, and existing controls. Threat modelling can therefore form one input into an organization’s wider risk management process.
