threat-model

What this skill does

Guides a structured threat modeling exercise for a target system using industry-standard frameworks: STRIDE (threat categorization), DREAD (risk scoring), PASTA (process-driven methodology), and Attack Trees (attack decomposition). Produces a threat catalog with MITRE ATT&CK mappings, a risk matrix, and a prioritized mitigation roadmap.

When to use

• During system design or architecture review to identify security risks before implementation
• When preparing for a security audit or compliance assessment that requires documented threat analysis
• When onboarding a new system into a security program and baseline threat coverage is needed
• When a significant feature or infrastructure change warrants re-evaluation of the attack surface

Prerequisites

• No external tools required (methodology/checklist-based)
• Access to system architecture diagrams, data flow diagrams (DFDs), or equivalent documentation
• Knowledge of the system's technology stack, trust boundaries, and data sensitivity levels
• (Optional) MITRE ATT&CK reference: https://attack.mitre.org

Inputs