Abuser Story
Field: Security · Also called: abuse story, evil user story, abuse case
An abuser story is a user story written from the point of view of a malicious adversary. Abuser stories are used in agile software development to define activities the software should actively block or mitigate, proven by automated regression tests.
Main article: What is an Abuser Story (Software)
Background
Abuser stories adapt the misuse and abuse cases that Hope, McGraw, and Antón described in 2004 to the user story format of agile development: whenever a feature is described, the team also considers how it could be unintentionally misused or intentionally abused. Like any user story, an abuser story is paired with tests that show when it is complete, in this case, tests proving the abuse is blocked.
Relation to Threat Modeling
Abuser stories are a tool useful in a threat modeling process.
Compatible with Story Tracking
A benefit of this format is it can be used with any story tracking system, such as GitHub Issues, Jira, or any equivalent system.
History
The same idea appears under several names, including evil user stories, abuse stories, and abuser stories. Johan Peeters used “abuser stories” in a 2008 paper on agile security requirements engineering. The term appears in What is an Abuser Story (Software) (Rietta, 2015).
Sources
- Misuse and abuse cases: getting past the positive, Hope, McGraw, and Antón, IEEE Security & Privacy 2(3), May 2004. Retrieved September 24, 2026.
See also
Go deeper
Articles
- Practical APPSEC starts with people first, processes second, and technology last February 4, 2021
- Patch Production Faster with Security-oriented Agile Development Practices October 28, 2019
- Writing Abuser Stories May 28, 2019
- Breach Prevention for Developers Talk at Kennesaw State University February 28, 2017
- What is an Abuser Story (Software) October 11, 2015
- What is Application Security? September 28, 2015
- What is an Abuser Story (Software) October 11, 2015