A practical approach to threat modeling that overcomes the paralysis of trying to be exhaustive. Instead of attempting to enumerate every possible risk, the technique involves crafting just two specific scenarios: a worst-case scenario (high impact, even if unlikely) and a most-likely scenario with tangible impact. Both scenarios should be written as detailed narratives rather than abstract categories, leveraging humans' natural affinity for storytelling. Drawing a parallel to Nielsen's usability testing research, even a single scenario yields significant insight, with rapidly diminishing returns after a few. The entire exercise can be completed in under a day and produces a threat model that teams can actually remember and act on.
Table of contents
Scenario-based threat modelingYou only need a few scenarios to generate a ton of insightTwo-scenario threat modeling48 Impressions