A threat model template answers four questions: what are we building, what can go wrong, what will we do about it, and did we do a good job. Specira's version walks the architecture by reference, sweeps every trust boundary with STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege), registers each threat with an Application Security Verification Standard (ASVS) identifier and a Common Vulnerability Scoring System (CVSS) vector, and scores risk on anchored scales. The decision it enables: which threats to mitigate, accept or eliminate.
Hand-written threat models redraw the architecture, restate the fixes, and rate risk on a scale nobody anchored. Then the architecture changes and the copy goes stale; the security requirements change and the mitigation text disagrees with them. The document was accurate once, at a workshop, and nobody can tell which parts still are.
What sections does a threat model template contain?
Specira's governed default template produces eight sections: typed tables for threats, STRIDE per component and per data flow, the register and the risk matrix, a generated attack tree diagram, and synthesized abuse cases and penetration test scope.
| Section | Depth | How it is produced |
|---|---|---|
| Top Threats & Mitigations | core | Table from typed items · Threat, Risk, Mitigation |
| STRIDE Analysis per Component | standard | Table from typed items · Threat, STRIDE Category, Component, Risk, Mitigation |
| Threat Register: STRIDE · ASVS · CVSS | standard | Table from typed items · Component, STRIDE Category, Threat, ASVS ID, CVSS Vector, Mitigation |
| Attack Trees for Critical Paths | standard | Generated diagram |
| Risk Scoring Matrix | standard | Table from typed items · Threat, Likelihood, Impact, Score |
| Full STRIDE per Data Flow | full | Table from typed items · Flow, STRIDE Category, Threat, Mitigation, Testing |
| Abuse Case Scenarios | full | Prose synthesized from discovery |
| Pen-Test Scope Recommendations | full | Prose synthesized from discovery |
How does Specira build the threat model?
The Security Analyst owns this artefact. It reads the security constraints and regulatory obligations in your knowledge base first, then works from the Solutions Architect's container, data flow and integration views rather than redrawing them. In the sample, section 1 (Scope and Assumptions) lists each trust boundary with its source and turns every assumption into a challengeable claim with a stated consequence if it falls. Section 2 (STRIDE Analysis) is a per-crossing sweep where each row is an attacker story, an existing control, a rating from the anchored scales, and a disposition that points at a security requirement row instead of restating the fix. Section 4 (Attack Surface) orders entry points by blast radius, not alphabetically, and reconciles them against the architecture's context view.
The Red Team Critic sits on every turn, so an abuse case the Security Analyst missed, or a threat with no cited architecture element, gets flagged inline as an evidence gap. Validators require every crossing to be analyzed or explicitly waived with an expiry, and the sample waives one transitional file drop exactly that way. A data flow whose disposition is still undecided renders as a named gap; Specira never invents a mitigation. Every row carries provenance and knowledge base citations with confidence scores. The export gate counts resolved decisions, ships deferred ones in the gap report, and delivers DOCX, Markdown, JSON or a push to Jira, Confluence, GitHub or Linear.
Rendered sample
Rendered from the Specira governed default template on a fictional company, watermarked, with its diagrams. Read it in the browser or take the PDF.
How do teams use the threat model?
- ✓Scope the penetration testThe scope section names in-scope assets, test types and the highest-risk areas, so the vendor quote starts from your priorities.
- ✓Drive the security requirementsEach mitigate disposition points at a requirement row, so the register and the model stay in agreement when either changes.
- ✓Re-model on a named triggerA cutover or a new boundary reopens the model on a trigger that is written down, instead of a yearly calendar reminder.
- ✓Brief the red teamThe threat register is the prediction the red team report tests, disposition by disposition.
What does the threat model look like inside Specira?
These screens show the Security Analyst walking a trust boundary, the Red Team Critic's inline abuse case note, and the compiled register with its dispositions.
Screens are from a seeded Specira demo workspace; counts and scores are sample data.
Book a demo and watch the Security Analyst sweep your first trust boundary with STRIDE in a single discovery session.
Book a Demo