Audit advanced Works with: Any AI

Threat Model for a New Feature

Decision tree

Create a lightweight STRIDE threat model.

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

Create a lightweight threat model for a new feature using a decision tree of STRIDE questions. Feature description and data flow: [FEATURE_AND_DATA_FLOW]. Users and roles: [USERS_AND_ROLES]. Technology: [TECHNOLOGY]. Data sensitivity: [DATA_SENSITIVITY]. Trust boundaries I know of: [TRUST_BOUNDARIES].

First draw the data flow in text: actors, processes, data stores, and boundaries. Then for each element ask:
IF it can be impersonated (Spoofing) THEN note how identity is checked.
IF data can be altered (Tampering) THEN note integrity controls.
IF actions can be denied (Repudiation) THEN note logging.
IF information can leak (Information disclosure) THEN note encryption and access.
IF service can be overloaded (Denial of service) THEN note limits.
IF privileges can be gained (Elevation of privilege) THEN note authorization checks.

Output a threat table: ID | Element | Threat | Likelihood (1-3) | Impact (1-3) | Existing control | Gap | Mitigation | Owner. Rank the top five. Add abuse cases and security tests for each mitigation, residual risks to accept explicitly, and the questions the team must answer before launch. Say which assumptions you made.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

• threat-model
• stride