Using the Threat Modeling Manifesto to Build an Enterprise Threat Modeling Program

The session starts from a common problem: most organizations agree threat modeling matters, but scaling it from a handful of experts to many engineering teams is hard. Centralized security teams and appointed champions tend to end up with a growing backlog of reviews they cannot finish. The speaker introduces the Threat Modeling Manifesto, written by a group of about fifteen practitioners, and explains its working definition of threat modeling as analyzing representations of a system to surface security and privacy concerns. The document borrows its structure from the Agile manifesto, listing values such as finding and fixing design issues over checkbox compliance, and people collaborating over process and tools.

The middle of the talk covers the principles, along with anti-patterns to avoid, such as the hero threat modeler and perfect representation, and positive patterns such as a systematic approach, creative brainstorming with varied viewpoints, and choosing tools only after the process is understood. The speaker then offers a set of tips for an enterprise program. These include a repeatable process built around scope and the four key questions, embedding the work in the secure development lifecycle and existing tools, building threat modeling champions and internal coaches, teaching through hands-on workshops, and drawing on STRIDE, ASVS, CWE and ATT&CK as sources of threats. Mitigations are presented as the real measure of value.

The closing takeaway is to model individual features first, keep quality checks supportive rather than punitive, and report results in terms stakeholders understand. The audience questions touched on feature-level versus whole-system models and on how to present threats and risk to executives.