Threat-Model Discipline

Overview

You cannot test what you have not modeled. A threat model names the assets, entry points, trust boundaries, relevant ATT&CK techniques, and existing mitigations — so coverage is deliberate, not accidental. On a long engagement the surface drifts (a new endpoint, a new dependency); un-reviewed drift is where bugs hide. This skill keeps the model complete and re-checks it for drift.

When to Activate

• At engagement start (after recon-osint), before weaponize/exploit.
• Whenever recon is re-run or the target changes — to catch new attack surface.
• At /engage.gate — the gate refuses to advance on un-acknowledged drift.

The model (JSON, materialized from recon)

threat-model.json (see templates/threat-model/): five required lists — assets, entry_points, trust_boundaries, attck (technique ids), mitigations.