Threat Modeling In And For Your Organization
summary
Practical recipe for turning threat modeling into an org program: concrete goals, reproducible process, measurables and templates. Claims a continuous threat modeling approach that ran across diverse Autodesk teams and scales with a small security staff. Recommends tools (PyTM, OASPiTM, diagrams-as-code, observability inputs), metrics to track like percent developers trained and attack surface coverage, and artifacts to build (security contracts, living threat models). Also lists common failures (hero threat modeler, tool-first thinking) and guidance on what actually worked.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 3:33What to expect
- 5:00Threat modeling defined
- 11:43Threat modeling program
- 16:19Key challenges
- 20:15Maturity models
- 23:05Measuring success
- 26:20Training developers
- 30:10Threat modeling at scale
- 34:02Scaling across orgs
- 36:10Training for scalability
- 40:03Tools in threat modeling
- 43:35Low-hanging fruit
- 46:03Documenting models
- 48:10Shared security use
- 50:13Templates importance
- 51:18Failures and anti-patterns
- 55:32Convincing stakeholders
- 56:37Final takeaways
related talks
49mThreat Modeling Panel
52mLessons From The Threat Modeling Trenches
01h 00mThreat Modeling for Secure Software Design
46mThreat modeling is on the rise
57mUnlocking Threat Modeling
50mThreat Modeling With Architectural Risk Patterns
11mThreat modeling state of practice in Dutch organizations
29mRedefining Threat Modeling: Security team goes on vacation