Skip to main content

Process Risks in Threat Modelling

Threat Modelling is a structured decision process that aims to identify, analyse and prioritise the threats relevant to a concrete system, in a given context.

Like any complex decision process, it is subject to risks of its own, independent of:

  • the method used (STRIDE, PASTA, LINDDUN, etc.),
  • the supporting tools,
  • the individual experience of the participants.

Failing to identify these risks explicitly compromises the reliability of the threat model produced.

1. Structural omission of threats​

Not all relevant threats are necessarily identified during a Threat Modelling session.

Omissions may result from:

  • limitations of the adopted method;
  • excessive focus on visible components;
  • lack of knowledge of adjacent domains;
  • uncritical reuse of previous models.

The absence of a threat from a model is not evidence that the threat does not exist.

Relates to. Violates THR-003; materialises MT-039.

2. Perspective bias​

Threat Modelling inevitably reflects the perspectives, experience and assumptions of the participants.

Common risks include:

  • undervaluing threats outside the immediate technical domain;
  • normalising known risks (“it has always been like this”);
  • overvaluing improbable scenarios at the expense of systemic failures.

This bias must be assumed as an inherent risk, not as an exceptional failure.

Relates to. No linkable requirement in the current catalogue; materialises MT-043.

3. Confusion between intermediate analysis and formal decision​

During the process, multiple intermediate artefacts are produced:

  • lists of potential threats;
  • session notes;
  • exploratory diagrams;
  • attack hypotheses.

These artefacts do not, by themselves, constitute an approved threat model.

The absence of a clear distinction between:

  • supporting material,
  • and validated decision,

introduces ambiguity and weakens risk governance.

Relates to. Violates THR-004; no linkable threat in the current catalogue.

4. Uncritical dependence on previous models​

Reusing previous models is a common and legitimate practice, but it introduces risks when:

  • the context has changed;
  • the architecture has evolved;
  • new dependencies have been introduced;
  • the risk profile has been altered.

Inherited models must be treated as starting hypotheses, never as validated truth.

Relates to. Violates THR-006; materialises MT-049.

5. Uncontrolled use of sensitive information​

The Threat Modelling process frequently involves:

  • detailed architectural diagrams;
  • sensitive data flows;
  • critical mitigation decisions.

These artefacts are high-value assets, subject to confidentiality, access control and retention requirements.

Relates to. No linkable requirement or threat in the current catalogue.

6. Plausible but incorrect results​

A threat model may appear:

  • coherent,
  • complete,
  • technically well articulated,

and still be incorrect or incomplete.

Plausibility is no substitute for validation, review and evidence.

Relates to. Violates THR-007; materialises MT-045.

7. Implications for the SbD-ToE​

The SbD-ToE explicitly assumes that:

  • Threat Modelling is a fallible process;
  • process risks must be treated systematically;
  • mitigating these risks requires human validation, explicit decision and verifiable evidence.

The controls associated with these demands are defined in this chapter's validation and evidence file.