Threat modelling
Four questions asked of a system (what are we building, what can go wrong, what are we going to do about it, did we do a good job) that make security a design activity instead of a scan at the end.
Evidence grade: practice A widely adopted practitioner model with clear provenance.
Use it when
The design review for any system handling personal or financial data; questions a manager can ask without being a security engineer.
Where it stops working
A threat model is a snapshot. Systems and threats move on, and a model nobody revisits describes a system that no longer exists.
Where the standard uses it
- TJ-6Security, privacy, and compliance as engineering responsibilitiesOwned by engineering, not delegated to a function.
Sources
- Adam Shostack. Threat Modeling: Designing for Security. Wiley, 2014. In the bibliography
Used alongside it
- Compliance as a programme practice
- Privacy by design practice
- Risk-based triage practice
- Security of AI-generated code research
Cite this model
Chicago, BibTeX and licence →Engineering Management Academy. (2026). Threat modelling. In Engineering Management Academy Body of Knowledge (Version 3.1, TEC.threat-modelling). https://www.engineeringmanagement.academy/body-of-knowledge/techniques/threat-modelling