STRIDE Threat Modeling

STRIDE is the most-used threat modeling methodology. It scales from a 30-minute napkin model to a multi-day deep dive. This skill is the engineering-grade walkthrough that produces an actionable risk register.

When to use

• Designing new auth, payments, or PII-handling flows.
• Architecture review for a new service.
• Before significant external exposure (public API, mobile app, third-party integration).
• After a near-miss / minor incident, before the next variant happens.
• Annual security review (lighter pass).

When NOT to use

• Internal tooling with low blast radius (still useful, but proportional effort).
• Pure compliance-driven model with no engineering follow-through — wasted artifact.

STRIDE in one table