Threat modeling is a structured way to ask "what can go wrong?" with a system's design. A diagram alone is not a threat model — it becomes one once every element has been walked through STRIDE and every threat has a disposition: mitigate, transfer, or accept. The exercises below practice exactly that, against systems whose diagrams are missing something. OWASP Threat Dragon is a free, open-source threat-modeling tool if you want to build your own diagram alongside them.
Opens the official Threat Dragon web app in a new tab. The "Demo" option works with no account — your model stays in your browser.
Violates: Authentication
Pretending to be another user, component, or system to gain trust you shouldn't have.
e.g. Forged JWT, stolen session cookie, or a rogue service impersonating your API.
Violates: Integrity
Modifying data or code in transit or at rest without authorization.
e.g. Altering a price in a request body, or patching a binary on disk.
Violates: Non-repudiation
Performing an action and then denying it, with no reliable evidence to prove otherwise.
e.g. A user disputes a transaction because there are no tamper-proof audit logs.
Violates: Confidentiality
Exposing data to people or systems not authorized to see it.
e.g. Verbose errors leaking stack traces, or an open S3 bucket of PII.
Violates: Availability
Degrading or denying service to legitimate users.
e.g. Unbounded request loops, resource exhaustion, or a volumetric flood.
Violates: Authorization
Gaining capabilities beyond those originally granted.
e.g. An IDOR that lets a standard user reach admin-only functions.
Vantle Financial's customer portal has a clean-looking data-flow diagram: a customer, a web app, an auth service, and a database. Walk it element by element with STRIDE, then find the one thing the diagram never showed you.
The partner integration diagram shows one trust boundary crossed by one flow. In production, two independent flows cross it — secured two very different ways.
A managed-service provider has standing remote access straight into a production host. It was never on the diagram, and the fix for it creates a risk of its own.
An HR self-service system and its nightly payroll export look straightforward until three unrelated integrations turn out to share one set of credentials at the same trust boundary.