Conduct Expert Threat Modeling and Security Reviews

A threat-modeling and security-architecture-review skill mastering STRIDE threat analysis, attack tree construction, data flow diagram analysis, security requirement extraction, risk prioritization and scoring, mitigation strategy design, and security control mapping. Its workflow runs in eight steps: define the system scope and trust boundaries, create data flow diagrams, identify assets and entry points, apply STRIDE to each component, build attack trees for critical paths, score and prioritize the resulting threats, design mitigations, and document residual risk. Best practices: involve developers directly in threat modeling sessions rather than doing it in isolation, focus on data flows rather than just components, explicitly consider insider threats, keep threat models updated after architecture changes, link each threat to a concrete security requirement, track mitigations through to actual implementation, and review regularly rather than only at initial design time. It also flags a safety concern of its own: avoid storing sensitive threat-model details without access controls, since the model itself can become an attack roadmap if it leaks.

Use proactively for security architecture reviews, threat identification, or building secure-by-design systems - designing a new system or feature, reviewing an existing architecture for security gaps, preparing for a security audit, identifying attack vectors, prioritizing security investment, creating security documentation, or training a team on security thinking. Not for use without scope or authorization for the security review, not a substitute for legal or compliance certification, and not a fit when only automated scanning is wanted with no human review - this skill is explicitly a human-reviewed methodology, not a scanner.

Input is the system or feature to be modeled, its trust boundaries, and its data flows. Output follows the eight-step workflow: data flow diagrams, an asset and entry-point inventory, a STRIDE analysis per component, attack trees for critical paths, a scored and prioritized threat list, designed mitigations, and documented residual risks.

References named methodologies STRIDE and PASTA and attack-tree modeling as its analytical frameworks, with no external tool dependencies beyond the methodology itself.

Security architects and engineering teams reviewing a system's architecture for security gaps or building secure-by-design from the start, who need a structured, repeatable threat-modeling process rather than an ad hoc security review.