Passeca - Governance, Risk management, and Compliance support
Under attack?
Threat Modelling

Threat modelling at design time

Find architectural flaws before code is written — on ThreatModeler. The cheapest security control you will ever buy, because the cheapest fix is a design change.

Book a free consultationThreatModeler partner page

Threat modelling is a structured analysis of a system's design to find security threats before it is built. Passeca facilitates threat modelling on the ThreatModeler platform — mapping architecture, trust boundaries and data flows, then generating threats systematically. The output is a prioritised set of security requirements that prevents architectural flaws at the point where a fix costs an hour, not an incident.

The thesis

The cheapest security control you will ever buy

Fixing a design flaw before code exists costs an hour of design time. The same flaw found in production costs an incident. Threat modelling is the highest-ROI security activity there is.

Every other security activity — SAST, SCA, penetration testing, incident response — finds flaws that already exist in built systems. Threat modelling is the one that moves the cheapest possible fix (a design change) to the earliest possible point (before code is written). No other control closes the gap between finding and fixing at so low a cost.

Passeca facilitates the design workshops, automates threat generation on ThreatModeler, and translates the output into a prioritised set of security requirements that engineering can act on. The model stays living, versioned with the architecture.

The ROI

Why fix cost favours design-time discovery

The same flaw, found at different stages, costs orders of magnitude different amounts to fix.

StageWhat you changeRelative cost
Design (threat model)A diagramHours
Code (SAST/SCA)Source codeDays
Pre-deploy (pentest)Code + re-testDays to weeks
Production (incident)EverythingCatastrophic

Threat modelling is the only activity that operates in the first column. Everything else finds the flaw later, at higher cost.

Benefits

What threat modelling gives you

Find flaws before code exists

Architectural weaknesses — trust-boundary violations, missing authentication between tiers, data-flow issues — are cheapest to fix when only a design diagram needs to change.

Prioritise downstream security work

A threat model tells you where to concentrate pentest, SAST and monitoring effort — on the assets and flows that actually carry risk.

Regulatory evidence

ISO 27001, SOC 2, DORA and NIS2 increasingly expect risk-based design. A documented threat model is direct evidence of secure-by-design practice.

A living artefact

On ThreatModeler, the threat model is versioned with the architecture — not a one-off document that goes stale, but a maintained view of risk as the system evolves.

Where it fits

Threat modelling, secure SDLC and pentest together

Three stages, three classes of risk. A complete preventive-and-detective pipeline needs all three.

ActivityStageClass of risk it catches
Threat modellingDesignArchitectural / trust-boundary flaws
Secure SDLC (SAST/SCA)Write / buildCode-level & dependency flaws
Penetration testingPre-deployRunning-system & business-logic flaws
Compliance

Which compliance requirements expect threat modelling?

FrameworkRelevant requirementHow threat modelling maps
ISO 27001:2022A.8.25 / A.8.27Secure development & secure system architecture
SOC 2CC8.1Change management & design
DORAArt. 9Secure ICT systems development
NIS2Art. 21Risk-based security measures, by design
PCI DSSReq. 6Secure software development
FAQ

Threat modelling, answered

When to do it, why ThreatModeler, ROI and compliance.

What is threat modelling?
Threat modelling is a structured analysis of a system's design to identify security threats before the system is built. By mapping the architecture, its trust boundaries, data flows and assets, then applying threat-generation frameworks, it surfaces architectural flaws — missing controls, insecure trust assumptions, exposed data flows — when they cost least to fix.
When in the lifecycle should threat modelling happen?
At design time — before code is written. The defining benefit of threat modelling is that it finds architectural flaws when only a design needs to change, not code, infrastructure or deployments. Retrospective threat modelling of existing systems is valuable too, but the ROI is highest when applied to new designs.
Why ThreatModeler?
ThreatModeler automates threat-model creation from architecture diagrams, applies threat-generation frameworks consistently, and keeps the model versioned alongside the system as it evolves. Passeca facilitates the modelling workshops, operationalises the platform, and turns the output into a prioritised set of security requirements for engineering.
Is threat modelling really 'the cheapest security control'?
Yes — by a wide margin. Fixing a design flaw at the whiteboard costs an hour of design time. The same flaw found in code costs days; found in production, it costs an incident. Threat modelling is the highest-ROI security activity because it moves the cheapest possible fix (a design change) to the earliest possible point (before code exists).
How does threat modelling relate to pentest and secure SDLC?
Threat modelling finds architectural flaws at design time; secure SDLC (SAST/SCA) finds code-level flaws at write time; penetration testing finds running-system flaws before deployment. Each addresses a different class of risk at a different stage. Together they form a complete preventive and detective pipeline.
Which threat-generation frameworks do you use?
Passeca applies established approaches appropriate to the system — STRIDE for common architectural threats, and framework-driven generation through ThreatModeler for systematic coverage. The choice is driven by the system type and regulatory context, agreed in scoping.
Which compliance frameworks expect threat modelling?
ISO 27001:2022 expects secure development and design (A.8.25, A.8.27). SOC 2 CC8.1 covers change management and design. DORA expects secure ICT systems development (Article 9). NIS2 Article 21 expects risk-based security measures including by design. A documented threat model is direct evidence for all of these.
How long does a threat-modelling engagement take?
A single system or service typically takes a few facilitated sessions plus write-up — around one to two weeks elapsed. A multi-service portfolio is delivered incrementally. ThreatModeler keeps each model living, so subsequent updates are far cheaper than the initial build.
Model before you build

Catch the architectural flaw at the whiteboard

Book a free consultation to scope a threat-modelling engagement on ThreatModeler — the highest-ROI security activity your team is not yet doing.

Book a free consultationThreatModeler partner page

Related

ThreatModeler partner pageDesign-phase threat-modelling platformSecure SDLCCode-level flaws at write timePenetration TestingRunning-system flaws pre-deployRisk ManagementTreat the threats you modelVirtual CISOOwn the secure-design programme from €1,950/monthBook a consultationFree scoping call