Threat Modeling
Apply threat modeling concepts and methodologies
Three threat modeling frameworks to know for the exam:
STRIDE (Microsoft) — software/application threats: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
OCTAVE (Carnegie Mellon) — organizational/enterprise risk assessment, self-directed by management.
VAST (Visual, Agile, Simple) — integrates into DevOps/Agile workflows with visual outputs for both developers and executives.
The exam tests which framework fits which context. STRIDE for apps, OCTAVE for enterprises, VAST for Agile teams.
Each framework serves a different audience and context:
- STRIDE is used during software design. Developers draw data flow diagrams and systematically check each component for each STRIDE threat category. It's granular and technical — ideal for identifying application-level vulnerabilities before code is written.
- OCTAVE is a self-directed, organization-wide risk assessment. Management identifies critical business assets, evaluates threats and vulnerabilities across the enterprise, and develops a protection strategy. It's broad and strategic — not designed for individual applications.
- VAST creates two parallel models: an application threat model for developers (based on process flow diagrams) and an operational threat model for infrastructure teams and executives (based on DFDs). It's designed to scale across Agile sprint cycles without slowing delivery.
Key distinction: STRIDE and OCTAVE require dedicated workshops outside the development cycle. VAST is the only framework explicitly designed to run inside Agile sprints.
| Framework | Origin | Focus | Best For | Audience |
|---|---|---|---|---|
| STRIDE | Microsoft | Software threats | Application design | Developers |
| OCTAVE | Carnegie Mellon | Organizational risk | Enterprise assessment | Management |
| VAST | — | Agile integration | DevSecOps pipelines | Developers + Executives |
Threat modeling happens during DESIGN, not after deployment. If the answer says "model threats during testing" or "after go-live" — it's wrong. The purpose of threat modeling is to identify threats before they're built into the system. Remediation during design is orders of magnitude cheaper than post-deployment fixes.
The security team is choosing a threat modeling framework for the entire organization.
Choosing the Right Framework
SaaS company · Agile development · 12 sprint teamsIn practice, most organizations use a hybrid approach. STRIDE for deep-dive application security reviews, VAST or a lightweight process for day-to-day sprint integration. Few organizations do pure OCTAVE unless they're running a formal enterprise risk assessment program.
On the exam: The question will describe a specific context (app design, enterprise risk, Agile team) and expect you to match it to the right framework. Don't overthink — match the audience and workflow.
Your organization is shifting from waterfall to Agile. The security team currently uses STRIDE for all threat modeling. Development teams are complaining that STRIDE workshops take too long and don't fit sprint timelines. You need to decide on the path forward.
Mandate STRIDE for all teams
STRIDE is the most technically thorough framework for software threats. Don't compromise security rigor for development speed.
Adopt VAST for Agile integration
Security must enable business processes. VAST is designed for Agile workflows and provides visibility for both developers and executives.
Option B is correct — security enables the business
Option B: A security framework that developers resist and skip is worse than a slightly less thorough framework they actually use. VAST was designed specifically for Agile environments. If the business uses Agile, security must integrate into that workflow — not fight against it.
Option A's kernel of truth: STRIDE is technically excellent for deep application threat analysis. It can still be used for high-risk components that warrant dedicated security reviews. But mandating it as the only approach in an Agile org creates friction and non-compliance.
On the exam: "Think like a manager" means enabling business objectives while managing risk. Security that blocks business processes is itself a risk.
When you see a context description + "which methodology": Match the context to the framework. Agile/DevOps + visual outputs = VAST. Application design + developer audience = STRIDE. Enterprise-wide + management-led = OCTAVE. The exam rarely asks you to explain a framework — it asks you to select the right one for a described situation.
- A STRIDE
- B OCTAVE
- C PASTA
- D VAST
Correct: D. VAST (Visual, Agile, Simple Threat) is specifically designed for Agile environments and produces visual outputs for both technical and executive audiences. STRIDE is app-focused for developers only. OCTAVE is enterprise-wide but too heavy for sprints. PASTA is a risk-centric 7-stage process not designed for Agile integration.