Threat Modelling
What is Threat Modelling?
A structured approach for identifying, quantifying, and addressing security threats to a system or application. Threat modelling analyses potential attack vectors and helps prioritise security controls during the design phase.
Terms that appear alongside threat modelling
Each of these is named in at least one of the same controls as threat modelling. The number is how many controls name both.
- secure coding 9 shared controls
- owasp 8 shared controls
- security testing 6 shared controls
- code review 5 shared controls
- nist 4 shared controls
- vulnerability 4 shared controls
- risk assessment 4 shared controls
- compliance 3 shared controls
Frameworks that govern threat modelling
What the standards actually require on threat modelling
Requirements naming threat modelling across 6 standards, quoted from the control text.
Agentic framework 2.1.1: weigh risk against benefit before building or deploying an agent (some tasks suit deterministic workflows better);
singapore-ai-governance-framework::AGT-2.1.1 · Select agent use cases by assessing impact and likelihood factors and threat modelling →Per OWASP ASVS V1: ensure verified application architecture + secure design + threat modelling. Requirements include (a) maintain documented secure software development lifecycle (SDLC) including security activities at requirements + design + implementation +...
OWASPASVS-1 · Architecture, Design and Threat Modelling (V1) →Per OWASP DSOMM Implementation dimension: implement secure software development practices. Requirements include (a) maintain secure coding standards aligned to language + framework + with developer guidance + (b) conduct threat modelling at design phase + revi...
DSOMM-2 · Implementation Practices, Secure Coding, and Threat Modelling →The development process is guided by threat modelling, follows secure coding, includes security testing aligned with global standards, and ensures secure deployment.
rbi-cybersecurity-framework-for-banks::83 · Para 83: threat modelling, secure coding, standards-aligned testing and secure deployment →Test regularly that logging works; maintain and review number analysis reference data used to configure signalling equipment; conduct threat modelling to inform risk assessments;
uk-telecommunications-security-act-2021::M24 · M24.01 to M24.09 New v1.1 measures by December 2029: logging tests, number analysis data, threat modelling, trusted boot, CPE anomaly blocking, service accounts, APIs and unused services →Management collects threat information from public and private sources as part of risk identification, and considers threat modelling to understand the nature, frequency and sophistication of threats, evaluate the institution's information security risks and a...
ffiec-it-examination-handbook::IS-II.A.1 · II.A.1 Threats (Information Security) →Questions people ask about threat modelling
What is Threat Modelling?
Why is Threat Modelling important for compliance?
Which compliance frameworks address Threat Modelling?
Where can I learn more about Threat Modelling?
See how Threat Modelling applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.