Contract

• Input: system architecture, data flows, users, deployment environment.
• Output: threat model document + risk register.
• Side effects: none.
• Dependencies: none.
• Stop condition: all assets mapped; risk register filled.
• Risk: low.
• Boundary: designs threat model; does not implement mitigations.

Threat Modeling

Build a threat model — assets, threats, vulnerabilities, mitigations — using STRIDE or ATT&CK.

Process

1. Define assets

What must be protected? Data (PII, credentials, business data), services (API, database), systems (servers, containers), users.