Beyond the Process: The Three Pillars of Threat Modeling

Preparing Systems to be Released into the Real World

According to the Threat Modeling Manifesto, “Threat modeling is analyzing representations of a system to highlight concerns about security and privacy characteristics.”

Today, I’d like to dissect what threat modeling truly is — beyond definitions and manifestos.

The manifesto is excellent. It provides details on what threat modeling entails, who should perform it, and why it matters. From a practitioner’s perspective, I’ve found it useful. However, it lacks something crucial — something that would give it real wings and make it genuinely helpful for every threat modeler.

Most writings on threat modeling miss this critical element: a perspective grounded in practical reality. I’m not introducing another framework or process here. Instead, I’m going to share augmented insights from real-world threat modeling — lessons I’ve learned by questioning every aspect of the whole process.

Photo by Imagine Buddy on Unsplash

I believe threat modeling is fundamentally based on three core pillars:

1. Asset Value
2. Cost of Security
3. Risk Tolerance

In essence, threat modeling is an optimization exercise: investing the right amount of security effort into assets that matter most, guided by how much risk the organization is willing to accept.

Asset Value varies based on context — specifically the domain (banking vs. retail), exposure (public-facing vs. internal), sensitivity (PII vs. public content), and criticality (national security vs. revenue-generating systems). The same data can be worth protecting with military-grade encryption in one context and basic access controls in another.

Cost of Security is the time, effort, and financial investment required to protect an asset. This isn’t just about buying tools — it includes engineering time, operational overhead, and the complexity added to systems and workflows.

Risk Tolerance represents how much residual risk the organization is willing to accept after security measures are applied. Different organizations — and different assets within the same organization — warrant different tolerance levels.

What we do as part of the threat modeling process is determine the optimal cost of securing an asset based on its contextual value while balancing the organization’s risk tolerance. We’re answering the question: “How much security is enough for this asset, in this context, for this organization?”

Finally, I’ll leave you with this question: Do you see threat modeling as a process to complete, or as a strategic exercise in balancing asset value, security costs, and organizational risk tolerance?