Threat Modeling
System → assets → actors → entry points → trust boundaries → threats → mitigations. STRIDE, attack surface mapping, attack trees, and how to run a security review on a real architecture.
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
System → assets → actors → entry points → trust boundaries → threats → mitigations: a repeatable hour of structured thinking that finds design flaws no scanner will ever find, because they are not bugs.
Six prompts — spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege — applied to each element of a diagram, which converts "think of what could go wrong" into a finite, checkable list.
Start from the attacker's goal and decompose it into every path that achieves it, so you can see which defense covers several branches at once and which branch nothing covers at all.
Take an architecture diagram and colour every node by exposure — public, authenticated, internal, privileged, highly sensitive — because the pattern that appears is usually more informative than any individual finding.
A repeatable interrogation you can run against any system diagram — yours, a candidate's, a vendor's — that produces specific findings in under an hour without needing to know the codebase.