Threat Modeling Workshops
Facilitated STRIDE Threat Analysis — Security Requirements Backlog and Detection Gap Mapping from Design, Not Findings
Threat modeling identifies security threats at the design level — before they become vulnerabilities in code or findings in a penetration test. This is 2-3 facilitated workshop sessions (2-3 hours each) that produce actionable security requirements, not a static document that sits unread.
Each session uses STRIDE threat analysis applied to data flow diagrams with explicitly defined trust boundaries. The output is a security requirements backlog formatted for your project management tool (Jira, Linear, GitHub Issues) — ready for sprint planning, not interpretation. Threats are mapped to MITRE ATT&CK techniques to identify detection gaps in your current monitoring.
The engagement includes a facilitator guide so your team can run threat modeling sessions independently going forward. The goal is capability transfer, not ongoing dependency.
Who This Is For
Ideal clients for this engagement.
The Problem
What this engagement addresses.
Security Requirements Discovered Too Late
Without threat modeling, security requirements surface during penetration testing or code review — after the system is built. Retrofitting security into completed architecture is 10-100x more expensive than designing it in.
Threat Models That Collect Dust
Many threat modeling exercises produce lengthy documents that no one references after the initial meeting. The output must be in the format engineering teams already use — backlog items in their project management tool.
No Connection to Detection
Traditional threat models identify threats but do not map them to detection capabilities. Security operations teams have no visibility into which threats the architecture is designed to face and where monitoring gaps exist.
Deliverables
What you receive.
Data Flow Diagrams with Trust Boundaries
System-level data flow diagrams with explicitly defined trust boundaries, data classification, and authentication/authorization points. The foundation for STRIDE analysis and ongoing architecture review.
STRIDE Threat Analysis
Systematic threat identification across all trust boundaries using STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). Each threat with likelihood, impact, and specific countermeasure.
Security Requirements Backlog
Threat-derived security requirements formatted for your project management tool (Jira, Linear, GitHub Issues). Each requirement linked to the originating threat, acceptance criteria defined, and priority assigned. Ready for sprint planning.
MITRE ATT&CK Threat Mapping
Identified threats mapped to MITRE ATT&CK techniques. Detection gap analysis showing where current monitoring would and would not detect the modeled threats. Directly usable by SOC teams.
Facilitator Guide
Step-by-step guide for running threat modeling sessions internally. Includes templates, STRIDE reference cards, facilitation tips, and common anti-patterns. Enables your team to self-run future sessions.
Methodology
How the engagement works.
Preparation & Architecture Review
Week 1
- Architecture documentation review
- Preliminary data flow diagram development
- Trust boundary identification
- Workshop scheduling and participant preparation
Facilitated Workshop Sessions
Weeks 1 – 2
- 2-3 workshop sessions (2-3 hours each)
- Data flow diagram refinement with the team
- STRIDE threat analysis across trust boundaries
- Countermeasure identification and prioritization
- MITRE ATT&CK technique mapping
Deliverable Production & Handoff
Within 5 business days of final session
- Security requirements backlog creation in team's project management tool
- ATT&CK detection gap analysis documentation
- Facilitator guide delivery
- Knowledge transfer session for future self-run workshops
Engagement Tiers
Scoped to your architecture.
Single System
One system or application. 2 facilitated sessions. Suitable for a single product, service, or feature area.
- 2 facilitated sessions (2-3 hours each)
- Data flow diagrams with trust boundaries
- STRIDE threat analysis
- Security requirements backlog
- Facilitator guide for future sessions
Multi-System
2-3 related systems or a platform with multiple components. 3 facilitated sessions with cross-system trust boundary analysis.
- Everything in Single System
- 3 facilitated sessions
- Cross-system trust boundary analysis
- MITRE ATT&CK threat mapping with detection gap analysis
Program Kickstart
Multi-system threat modeling plus establishment of an internal threat modeling practice. Includes additional training and methodology customization.
- Everything in Multi-System
- Customized threat modeling methodology for your organization
- Extended facilitator training (half-day session)
- Template library for ongoing use
Prerequisites
- Architecture documentation or system diagrams (even informal ones)
- Participation from engineers who designed and built the system
- Product or business context for data sensitivity and compliance requirements
- 2-3 hour blocks for workshop sessions with key stakeholders
Frequently Asked Questions
Common questions.
Who should participate in the workshop sessions?
The engineers who designed and build the system — architects, senior developers, and tech leads. Security team members if available. Product managers for business context. Typically 4-8 participants produces the best results. Too few and you miss context; too many and the session loses focus.
What if we do not have architecture documentation?
That is common and expected. The first workshop session includes collaborative data flow diagram development — building the architecture view together with the team. This often surfaces misunderstandings about the system's actual trust boundaries that documentation would not have captured anyway.
Can our team run threat modeling sessions on their own after this engagement?
That is the goal. The facilitator guide, templates, and knowledge transfer session are specifically designed to enable self-run sessions. The engagement builds internal capability, not ongoing dependency.
Related Offerings
Often paired with this engagement.
Penetration Testing
Validate threat model findings through adversarial testing — confirm which modeled threats are exploitable in the running system.
Secure AI Architecture
STRIDE threat modeling specifically adapted for AI systems — trust boundaries around models, RAG pipelines, and agent frameworks.
AppSec Program Design
Embed threat modeling into your SDLC as a standard security gate — make it a repeatable practice, not a one-time exercise.
Ready to discuss this engagement?
30-minute discovery call. We will discuss your application architecture, your specific concerns, and whether this assessment is the right fit.