Practical Threat Modeling

Threat modeling works best when it feels like engineering judgment, not paperwork. I want the risky assumptions on the table early enough that the team can still do something useful with them.

The Short Version

If I only have thirty minutes, I want answers to four questions:

1. What is the system trying to do?
2. Who or what can influence it?
3. What would be bad if it happened?
4. What control makes that bad thing hard?

That is enough to start.

Worksheet

Area	Questions
System shape	What is being built? What data enters and leaves? What runs later or asynchronously?
Actors	Who can use it? What can unauthenticated, low-privilege, admin, service, or integration actors do?
Trust boundaries	Where does identity change? Where does untrusted input become trusted state?
Sensitive actions	What changes data, grants access, sends messages, starts jobs, or calls tools?
Failure modes	What happens when validation fails, retries happen, or dependencies are unavailable?
Observability	What would we need logged to understand abuse or failure later?

Questions I Like

• What does the UI prevent that the server still has to enforce?
• Can one user, tenant, workflow, or integration influence another?
• What happens if this input is oversized, malformed, delayed, replayed, or reordered?
• What should be impossible even if a queue retries or a background job runs late?
• What would be dangerous if an AI agent or integration triggered this path?
• What data ends up in logs, notifications, exports, or generated output?

Write The Threat As An Assumption

Instead of writing:

Broken access control may occur.

Write:

We assume the caller can only request records they already own. That assumption is enforced by
[control]. The review question is whether every read path uses that control.

That version can be tested.

Leave With Three Things

A useful threat model should leave the team with:

• The highest-risk assumption.
• The control that makes the assumption safer.
• The test or review step that proves the control exists.

If the team leaves with those three things, the threat model did its job.