The way I threat model is I use a tool I developed and a conversation with PMs and devs/architects to determine each thing we're protecting, the current state o

The way I threat model is I use a tool I developed and a conversation with PMs and devs/architects to determine each thing we're protecting, the current state of what we plan to use to protect it, who we're actually protecting it from, and the tech stack it depends on. It creates a bunch of visualizations that everyone up and down the chain can understand quickly, which update dynamically as we add new security features, and which reflect complete tracability of the technical reality from an engineering perspective, along with a gap analysis that product, security, engineering, compliance, and security can reason about. The side effect is a visual security architecture, and an objective attack surface for your post-controls like VAs and pen-tests. Then the tool automatically generates epics and stories that import into Jira so we can build security controls as features and manage them in iteration planning and standups. Just this week I put a 50 page architecture doc through it in about an hour and provided an agency director with a concrete security posture that demonstrated how it had lots of controls for prevention, but none to detect or respond to the threats we actually cared about, and that this should be the substance of their conversation with the vendor. If you want to know why you should threat model, I'm also using it to support the sales org at a new security product company by modelling the security of target customers' products and showing how their authN product fills gaps it illustrates in the customer's products, and I use it personally for fast modelling attack surfaces on gigs. One client called it the "Deloitte killer," because it does in a couple hours what big-5 consultancies take weeks and $50k to do. That's generous, as people hire those companies for compliance and not to build better products. My tool is not a product because it alienates other security and compliance people, and product/project people mostly care about having them onside. My personality probably doesn't help either. :) IMO, STRIDE is bike shedding. Real threats are counter-cases to your product's business model.