FAIR STRIDE - Building business relevant AppSec threat models

Application security teams often describe vulnerabilities by their effect on systems, while executives make budget decisions in money. This talk presents a way to close that gap. It pairs STRIDE threat modeling with the FAIR quantitative risk framework, expressing threats as estimated financial losses over a twelve-month period rather than severity labels that cannot be added together.

The method splits risk into how often a loss event happens and how large the loss would be, with costs such as engineering time, fines, and public relations work counted separately. Estimated ranges feed a Monte Carlo simulation that produces thousands of simulated years. The result is a curve showing the chance of exceeding a given loss. A live spreadsheet demo shows a parser-level fix lowering simulated losses, so a technical control and a process change can be compared in the same units.

The practical takeaway is that these curves give leadership a baseline and a target they can agree on, and progress can be tracked from one yearly cycle to the next. The speaker argues this helps teams prioritize beyond compliance checklists and makes improvement visible. Feature-level threat modeling still happens separately. Audience questions covered whether the approach suits smaller organizations and how results roll up across many applications.