Most breaches do not start with a zero-day. They start with an attack surface nobody mapped: a forgotten subdomain, an over-permissioned API key, a third-party integration nobody threat-modeled. Threat modeling and attack surface analysis are how you find those gaps before an attacker does, and they are core skills tested on the CISSP and increasingly expected of anyone running a security program.
What Threat Modeling Actually Answers
Threat modeling is a structured way to answer four questions about a system: what are we building, what can go wrong, what are we going to do about it, and did we do a good enough job. Skipping straight to controls without asking those questions is how teams end up with expensive defenses pointed at the wrong risks.
STRIDE: Modeling Threats by Category
STRIDE breaks threats into six categories — Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege — and asks you to walk each component of a system (or each element of a data flow diagram) against all six. It is the fastest way to go from “we should think about security” to a concrete list of things that can go wrong in this specific system.
PASTA: Modeling Threats by Business Risk
Where STRIDE is component-by-component, PASTA (Process for Attack Simulation and Threat Analysis) works top-down from business objectives: define what the application is for, decompose it technically, analyze real threat intelligence and attack patterns against it, then simulate attacks and score the residual risk. It is heavier than STRIDE but produces output executives can actually prioritize against, which matters when you are competing for budget.
Mapping the Attack Surface
Your attack surface is every point where an untrusted input can reach your system — external endpoints, APIs, third-party integrations, cloud storage buckets, forgotten dev/staging environments, and every account with standing access. A useful exercise: list every way data or a request can enter your environment, then for each one ask who can reach it and what they could do if they were malicious.
- External-facing web apps, APIs, and admin panels
- Third-party integrations and vendor API keys
- Cloud storage buckets and their public-access settings
- Forgotten staging, dev, and demo environments still reachable from the internet
- Accounts and service credentials with standing privileged access
Turning Findings Into a Risk Register
A threat model that lives in a slide deck and never gets revisited is wasted effort. Every finding should land in a living risk register with a description, likelihood, impact, an owner, and a remediation deadline — the same register you will lean on later when you need to report risk up to the board.
Get the Free Threat Modeling & Attack Surface Analysis Cheat Sheet
We put the STRIDE and PASTA workflows, an attack-surface inventory checklist, and a starter risk register template into one download — free, no strings attached.
Running a Small Business? Start Here
If you do not have a dedicated security team, a lightweight threat model of your customer-facing systems is one of the highest-leverage security exercises you can run in an afternoon. See how we help small businesses build a right-sized security posture.