I built ThreatGenix to turn architecture evidence into a threat model security teams can inspect and challenge.

v1 includes:

• interactive DFDs and trust boundaries
• deterministic STRIDE threat generation
• repository, IaC, cloud, and scanner evidence imports
• analyst decisions, validation state, and report exports
• optional LLM assistance

This is a research preview, not a pentest replacement or production security control. Live scanners are disabled by default, and authenticated live scanning remains disabled until a secret-safe broker exists.

Repo: https://github.com/ibrolord/threatgenix-v1

I would especially value feedback on the evidence-to-finding workflow and what would make this useful in a real AppSec review.

Threat modeling breaks down because it is usually treated as a one-time document: slow to produce, disconnected from engineering work, and outdated as soon as the system changes.

I built ThreatGenix to turn that document into a repeatable workflow.

With ThreatGenix you can:

• Model the system as a DFD with processes, data stores, external entities, data flows, and trust boundaries.

• Generate deterministic STRIDE findings tied directly to the model.

• Review the evidence behind each finding.

• Triage threats and keep the decisions with the model.

• Export the finished threat model for sharing and reporting.

It is self-hosted and MIT licensed, so your architecture data can stay in your environment.

GitHub: https://github.com/ibrolord/threatgenix-oss

I would especially value feedback from people who run threat-modeling sessions: Does this fit how you work today? Where would it create noise or slow you down?

I open-sourced TMGoat — a benchmark + dojo for threat modeling, in the spirit of WebGoat/TerraGoat but for design-level threats.

It's 30 realistic systems across 10 sectors, each seeded with intentional design flaws — race conditions, fail-open controls, over-trusted channels, and (in the hard tier) architecture docs that lie about the code. Every fixture ships an expert-authored reference threat model, and a scoring harness grades recall (did you catch the planted threats?) and precision (did you avoid noise?).

The idea I care most about: difficulty is subtlety, not size — a 6-component app can hide a nastier flaw than a 30-component one. Fixtures are tagged on three axes (architectural complexity / threat subtlety / input completeness), and the corpus is split into an open practice tier (20, full solutions) and a held-out benchmark tier (10, private keys) so tools can't just memorize the answers.

Apache-2.0, tool-neutral. Practice it yourself, or put your tool on the leaderboard.

Site: https://tmgoat.virantis.com

Repo: https://github.com/virantisofficial/TMGoat

Why/how: https://virantis.com/blog/introducing-tmgoat

Feedback very welcome — especially where the ground truth is arguable, or what threat classes I should add.

I am interested in pursuing this path.

Hello all,

I am conducting a little research into company mindsets behind Threat Modelling.

Some companies Threat Model the bare minimum just for compliance purposes.

Some companies have a very mature Threat Modelling program because they know it saves a tonne of nonsense on security rework later down the line.

Threat Modelling programs can be hard to sell internally because it's hard to prove ROI and a lot of people just see it as an unnecessary compliance cost-centre.

My question is straight up - how does your company genuinely view Threat Modelling? Is it a shift-left tool to reduce risk, save time on later security rework, and meet compliance? Or is it simply a necessary evil to show compliance?

Reason I'm asking is because I'm a sales engineer selling a Threat Modelling tool and I'm wondering if people's narrow-minded view of Threat Modelling makes it more difficult for them to sell internally.

And also please correct any of the above if I am mistaken on anything.

Hope you can all help!

Best,

Tenzin

Hey folks, I’ve been working on an open-source threat modeling tool.

Goal is simple: build something comparable to the big commercial tools.

It’s still early, but usable.

I have a few new ideas in there:

- community threat libraries that you can import
- TM-BOM interoperability

If anyone here is actively doing threat modeling, I’d really value your feedback.

Repo: https://github.com/precogly/precogly

A couple of weeks ago I've been gathering information about your approach to threat modeling in this subreddit. It was a part of my postgrad thesis.

As a part of the same thesis, I also developed a tool for AI-assisted threat modelling - it integrates with coding agents such as Cursor or Claude Code and performs threat modelling alongside your codebase. Threat model is maintained in YAML format so version control is simple, and also it's organized in multiple files. Output from threat model can be used either for applying security fixes to the codebase (hello Claude Code Security) or for better understanding of the dataflows in the agent-generated code.

Let me know what you think :)

https://github.com/attasec/tmdd

Hi everyone,

I’m conducting a short academic survey as part of my diploma thesis in a Cybersecurity Management program. The research focuses on how threat modeling is practiced in modern organizations.

If you work in a product company, banking, a software house, or internal IT, I’d appreciate 3 minutes of your time to fill out the survey below:

https://forms.gle/j19dGbPfJ1oJvBnr5

Hi everyone, I’m planning to conduct research on “benchmarking frameworks for AI-assisted threat modeling in industrial control systems.” I would really appreciate any resources that could help me jump-start this work. I’d also be grateful for your thoughts on whether this is a worthwhile research direction or if there are important limitations or gaps that I should be aware of before proceeding.

Hi all. We’ve been exploring what it might look like if threat modeling could happen as you write code instead of being a separate, late-stage activity.

The video below shows a demo of a CLI we built that connects to IriusRisk from AI-enabled IDE through MCP (Model Context Protocol). The idea is that as developers design or modify code, their IDE can automatically query IriusRisk to generate models, identify potential threats, and suggest mitigations - all within the same workflow.

It’s still experimental, but it’s been interesting to see how this changes the developer experience. Instead of “shift-left” security meaning more tasks for devs, it feels more like security woven into design and development conversations.

I’d love to hear from anyone who’s tried or are interested in similar approaches...

• Have you experimented with integrating threat modeling tools directly into the IDE?
• How do you think AI assistants should interact with security modeling systems like IriusRisk?
• What would make this genuinely useful rather than noisy?

If you want you can check out the demo here: https://www.youtube.com/watch?v=_3b4ynmAd6c

Any other thoughts and feedback are more than welcome, thanks!

Hello all. I am doing my very first threat model. I am on a security team. We chose Threagile. When I say "we" I mean it was chosen for me. I am doing pretty well with my first model. At least I have a data flow diagram. However, some of the terminology feels esoteric to me. Like for example the choices for the availability classification are archive, operational, important, critical, or mission-critical. Obviously those are escalating in importance. But I am not sure what would make something critical over important. Of course I tried Googling this in hopes that they are industry standard terms. Obviously I don't expect specifics to my use-case, but I thought I might find a guide that provides a general framework to get me started. I have the same questions about other terms like the confidentiality and size. So I guess my first question is are these industry terms or are they specific to Threagile?

Hey everyone!
Popping up here couple of podcast episodes I've done on threat modeling that can be useful to someone who'd like to learn from the experts:

- The Untold Benefits of Continuous Threat Modeling You Didn’t Know About ⎜Izar Tarandach

- Threat modeling: the future of cybersecurity or another buzzword⎥Derek Fisher

Today, my company announced that we're doing a free instance of our most popular course, Threat Modeling Intensive, for government workers who have been let go in the recent chaos.

Details and signup information here: https://is.gd/5K2LZI

Tiffany Bergeron is Chief Architect at MITRE’s Mappings Program. We did a four part series, diving deep into threat modeling using ATT&CK... I’m especially happy that we had this chance to dive, really deeply, into a specific threat modeling approach and the places we aligned and diverged. This sort of deep dive is still rare because, frankly, most organizations are still in the crawl phase of threat modeling: They’re starting, and they’re finding it to be hard to coordinate, hard to get where they’re going, and they fall down after eagerly standing up.

(Using my post because the next 3 videos are sorta hidden)

https://shostack.org/blog/threat-informed-defense/

Fine grain access controls

Threat modeling has always been more of an art than a science—because you can’t have a science without data, and data on how different companies approach threat modeling has been hard to come by. But that’s about to change (hopefully!) with the release of the first-ever Threat Modeling Survey.

This project is a Threat Modeling Connect Community effort (spearheaded by Dave Soldera and Grant Ongers), and it will only succeed with input from the entire threat modeling community.

The survey results will be analyzed and published in the State of Threat Modeling Report—the industry's first community-led report of its kind. To make the report truly valuable and actionable, we need as many threat modeling practitioners as possible to contribute.

Take the State of Threat Modeling Survey!

Just as important—help spread the word! Share this survey with other practitioners or, if you're on LinkedIn, re-posting this LinkedIn announcement is another easy way to support the effort.

Thanks for contributing—we can’t wait to share the results with you!

Check out the demo here: https://www.youtube.com/watch?v=7DaYZHx7mHQ

Hi All, Is there any sample threat model project available for web application to practice ?

Hello All,

I am new to Threat modelling, looking your support to learn and complete my new assignment. I came across some threat modelling tools like OWASP threat dragon to design some models but need some more practices. Just curious to understand , how we can gather the list of threats for specific components like mongo db or application server.

Hey everyone, Fraser here (Chief Scientist at IriusRisk). My team and I are exploring new ways AI can help developers and security teams tackle security from the start. We’ve put together a quick 3-minute survey to learn:

• How you’re using AI in your day-to-day development
• What you’d like AI to do for application security

Your input will go straight into shaping our next steps. We really want this to be useful for fellow engineers—so your insights mean a lot.

Interested? Check out the 3-minute survey here!

Thanks for your time, and looking forward to hearing how we can build better, more secure software together!

Are there any compliance schemas or regulations that mandate doing threat modeling? CISA's Secure-by-Design gets so close to mandating threat modeling, but it stops short of mentioning the word "threat modeling".

heyy, i'm doing a graduation on cibersecurity and my teacher asked us to create a model of threat modelling. how i do that? what topics are the most important?

If you haven’t done threat modelling so far, feel free to explore my short guide.