Threat Modeling
Field: Security
Threat modeling is a structured process for identifying what a system must protect, enumerating what can go wrong, and prioritizing mitigations by relative risk.
Risk scoring
Threats are commonly ranked with the formula Likelihood × Impact = Risk. The values are relative, not absolute measurements: their purpose is to make findings comparable so the highest risks are addressed first. Consistency in scoring matters more than the specific numbers.
Beyond security
The same method of listing what needs protecting, enumerating what can go wrong, and scoring the results can be applied to other kinds of organizational risk. Rietta’s articles apply it to digital accessibility, treating inaccessible documents as risks to be enumerated and prioritized.
Sources
- Threat Modeling Cheat Sheet, OWASP Cheat Sheet Series. Retrieved September 23, 2026.
See also
Go deeper
Articles
- Threat Modeling for ADA/WCAG Compliance July 28, 2026
- Practical APPSEC starts with people first, processes second, and technology last February 4, 2021
- What is an Abuser Story (Software) October 11, 2015