Threat Modeling (STRIDE)

Overview

Produce a lightweight, sprint-compatible threat model: 15-30 minutes of structured analysis, not a multi-week security assessment. The output is a threat model document plus security stories the team can schedule.

When to Use

• Designing a new feature or API endpoint
• Reviewing architecture changes
• Integrating with third-party services
• Processing personal data, payment data, or regulated data
• Sprint planning or design review sessions
• Any change that crosses a trust boundary

Process

1. Establish the Data Flow