The Threat Model Canvas brings security into the product development process as a structured exercise. By mapping threats to vulnerabilities to controls, teams ensure security is designed in rather than bolted on after the fact.
What are the security threats to our product and how are we protecting against them?
Map your security posture across six cells: Threat Models, Threats, Vulnerabilities, Controls, Policies, and Reviews. A structured approach to security threat modelling.
Inspired by STRIDE threat modelling (Microsoft, 1999) and Adam Shostack's Threat Modeling: Designing for Security. The canvas format adapts threat modelling for product teams.
Use STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) as a checklist for identifying threats. Map every threat to at least one control or an acceptance decision. Review the canvas after every major architectural change.
Don't treat threat modelling as a one-time exercise — new features introduce new attack surfaces. Avoid defining controls that exist only on paper; verify they're actually implemented and tested. Don't skip Policies — technical controls without enforced policies create false security.