Prompt Threat Modeling

# Prompt — Threat modeling

> [🇷🇺 Русский](../ru/prompt-threat-modeling.md) · 🇬🇧 **English**

[← Index](./README.md) · [Standards](./standards.md) · [Template](./template.md)

tags: #prompt #threat-modeling #security #review #single-shot
**Status:** `🧪 Experimental`
**Owner:** Pandamy619
**Last edit:** 2026-05-20
**Version:** v1
**Source idea:** [Microsoft — STRIDE Threat Modeling](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats), [OWASP — Threat Modeling Process](https://owasp.org/www-community/Threat_Modeling_Process)
**Delta from original:** mandatory DFD (or explicit list of trust boundaries) before STRIDE analysis, required likelihood × impact matrix, explicit residual risks section. Candidate to be rewritten as `#critique` genre (see backlog).

---

## When to use

- Before launching a new service or making a substantial change to an existing one
- Before a security review or compliance audit
- When the team is unsure which threats are real and which are theoretical

## What to substitute

- `{{system_description}}` — string, e.g. `payments-api receives requests from mobile/web, validates, sends to Stripe, persists to Postgres, emits event to Kafka`
- `{{data_classification}}` — string, e.g. `PCI DSS (PAN, CVV); GDPR (PII); secrets (API keys); internal (logs)`
- `{{trust_boundaries}}` — list, e.g. `internet → API gateway; gateway → service; service → DB; service → Stripe; service → Kafka`
- `{{entry_points}}` — list, e.g. `POST /v1/payments (public, authed); GET /v1/admin/payments (internal, JWT scope admin); webhook from Stripe (public, signature-verified)`
- `{{assets_at_risk}}` — list, e.g. `customer payment data; transaction history; API keys; user PII`
- `{{compliance_context}}` — string, e.g. `PCI DSS SAQ-D; GDPR; SOC 2 Type II`
- `{{attacker_profile}}` — string, e.g. `internet attacker (low skill); insider (employee); compromised dependency; nation-state (out of scope)`

## Definition of done

Universal minimum — see [Definition of done](./standards.md#2-definition-of-done).

Specific criteria:

- DFD is shown (as text or Mermaid), with trust boundaries explicitly marked
- STRIDE is worked through for each trust boundary, not "for the system as a whole"
- Each risk has likelihood (Low/Med/High), impact (Low/Med/High), and mitigation (existing / proposed / accepted)
- Residual risks are listed — what's NOT closed and why
- For each mitigation, it's specified how to verify it works

## Prompt