Agile Threat Modeling with Open-Source Tools

on YouTube ↗30m

" summary

Claim: Threagile turns threat models into YAML model as code that live in Git, generate diagrams and reports, and track mitigations. It runs as a CLI and REST API (Docker image, MIT license), evaluates models with over 40 built-in risk rules plus plugins, and emits JSON/Excel/PDF with per-risk IDs, states, and OWASP-linked mitigation steps. Demo shows GitHub Action integration and automated runs in CI/CD; outputs are reproducible and designed to be machine-checkable.

AI-written summary · about

" chapters (27)

1. 0:00Intro
2. 1:34Threat Models as Code?
3. 1:50Benefits of Code
4. 2:49Drawbacks of Code
5. 6:59Threagile - Agile Threat Modeling Toolkit
6. 9:49First Steps with Threagile Create either a minimal stub model or a filed example model
7. 10:10Example Model: Data Assets
8. 11:43Example Model: Communication Links
9. 12:37Example Model: Trust Boundaries
10. 13:23Execute a Threagile Run Processes the YAML model file
11. 13:37Model Graph Generation (Data Flows)
12. 14:09PDF & Excel Report Generation
13. 15:53STRIDE Classification of Risks
14. 16:14Assignment by Function
15. 16:35Relative Attacker Attractiveness (RAA)
16. 18:33Data Breach Probabilities (DBP)
17. 20:00Risk Mitigation Recommendations
18. 20:52Risk Instances by vulnerability & by tech as
19. 21:40Detail Results as JSON
20. 21:51Risk Rules -40 and constantly growing
21. 22:26Editing Support in IDES Schema for YAML input available Enables syntax validation error flagging & auto-completion
22. 23:00Risk Tracking inside YAML file by Risk-1
23. 23:49What About Bigger Models?
24. 24:24Model Macros: Interactive Wizards Interactive wizards reading existing models and modify/enhance them
25. 24:36GitHub Integration (as workflow action)
26. 25:15Possible Effects
27. 27:30Upcoming Features currently in developme

" related talks

• 34mThreat Model-as-CodeAbhay Bhargav · OWASP AppSec USA 2018
• 47mAutomating Architectural Risk Analysis with the Open Threat Model formatFraser Scott · Global AppSec US 2021 Virtual
• 46mThreat modeling is on the riseEmil Kvarnhammar · Øredev 2022
• 31mThreat Modeling for Kubernetes: Enhancing Security Posture in Complex and Regulat...Maxime Coquerel · Open Source SecurityCon North America 2025
• 58mThreat Modeling In And For Your OrganizationIzar Tarandach · Global AppSec Dublin 2023
• 38mIterative Threat Modelling: Security in Agile DevelopmentJagdsh Chand · Conf42 DevSecOps 2023
• 21mA tool to help improve your threat modelingDarran Boyd, Jessie Wei · AWS re:Inforce 2023
• 53mThreat Modeling: uncover vulnerabilities without looking at codeChris Romeo · NDC TechTown 2018