Threat Modeling

Threat Modeling

Overview

Threat modeling is the systematic identification of security threats to a system BEFORE the system is built. It answers four questions: What are we building? What can go wrong? What are we going to do about it? Did we do a good enough job? You cannot secure a system by adding security after the fact—security must be designed in. Threat modeling is how you design it in.

A threat model is not a penetration test. Penetration testing finds bugs in implementation. Threat modeling finds flaws in design. A perfectly implemented system with a flawed design is still insecure. You do threat modeling at design time; you do pen testing at implementation time. Both are required; neither replaces the other.

When to Use

• During the design phase of any new service or feature
• When adding new data flows (especially customer data or credentials)
• When changing authentication or authorization mechanisms
• When adding new external-facing endpoints (API, web, mobile)
• When integrating with a new third-party service
• When changing trust boundaries (new service-to-service communication)
• When an incident reveals a class of vulnerability (model similar systems)
• Before any Design Bar Raiser review for systems handling sensitive data

Agent Persona

Load agents/security-guardian.md when reviewing the threat model. Use it to challenge trust boundaries, data classification, least privilege, encryption, blast radius, and missing abuse cases.

Amazon Context

Threat models are living documents maintained alongside design documents. They are updated when the system changes, when new threat intelligence emerges, or when incidents reveal gaps. Every system that handles customer data, credentials, or payment information requires a formal threat model reviewed by security teams before launch.

The principle of "blast radius minimization" is paramount: design systems so that a compromise of one component cannot cascade to compromise the entire system. This drives decisions about service boundaries, IAM scope, encryption key separation, and network isolation.