Sources of truth
The frameworks we build on.
Every question, every outcome code, every principle reference traces back to one of these canonical sources. Verify URLs are live before relying on them.
Threat Modeling Manifesto
Values and principles; modelled on Agile Manifesto by 15 practitioners.
Threat Modeling Capabilities
2024 follow-up; catalogue of real threat-modelling programme capabilities.
The Four Question Framework
Shostack’s 2024 paper on the precise wording of the four questions.
NCSC Cyber Assessment Framework
Four objectives, fourteen principles, thirty-nine outcomes, 443 indicators; outcomes-based.
NCSC Threat Modelling Guidance
UK national-authority position; threat modelling as business-as-usual in risk management and CI/CD.
CAF-aligned DSPT Guidance (NHS England)
2025/26 toolkit aligned to NCSC CAF with Objective E; submission deadline 30 June 2026.
ICO: Data protection by design and by default
UK regulator’s guidance on baking protections into design before processing.
GDPR Articles, linked to Recitals
Direct access to every article; useful for resolving exact wording.
AWS Well-Architected: Threat modelling
Amazon’s adoption of Shostack’s four questions as Security Pillar best practice.
Threat modelling generative AI workloads
Worked example using STRIDE, OWASP Top 10 for LLMs, MITRE ATLAS.