threagile

Threagile Agile Threat Modeling Toolkit Threagile see threagile.io for more details is an open-source toolkit for agile threat modeling: It allows to model an architecture with its assets in an agile fashion as a YAML file directly inside the IDE. Upon execution of the Threagile toolkit all...

threat-modeling-mcp-server

Threat Modeling MCP Server A Model Context Protocol MCP server for comprehensive threat modeling with guided code validation. Table of Contents Overview Quick Start Prompts Key Features Prerequisites Installation Running with Kiro CLI Output File Management Quick Reference Tools Overview Threat...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. It is an OWASP Incubator Project. The focus of the project is on great UX, a powerful rule engine and integrati...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

threatspec

threatspec - continuous threat modeling, through code Threatspec is an open source project that aims to close the gap between development and security by bringing the threat modelling process further into the development process. This is achieved by having developers and security engineers write...

ws4-secure-design-agentic-systems

CoSAI Workstream 4: Secure Design Patterns for Agentic Systems This repository is for the work of the CoSAI Workstream 4, Secure Design Patterns for Agentic Systems. CoSAI is an OASIS Open Project and an open ecosystem of AI and security experts from industry leading organizations dedicated to...

threatcl

threatcl Threat Modeling with HCL What happened to hcltm? hcltm has been renamed to threatcl. Welcome! Overview !TIP Want to read the new documentation? Head over to threatcl.dev There are many different ways in which a threat model can be documented. From a simple text file, to more in-depth wor...

threat-dragon

build latest practices OWASP Threat Dragon OWASPowasp Threat Dragonproject is a free, open-source, cross-platform threat modeling application. It is used to draw threat modeling diagrams and to list threats for elements in the diagram. Mike Goodwin created Threat Dragon as an open source communit...

appsec-agent

AppSec Agent AI-powered security agents for code review, PR scanning, threat modeling, fix generation, and more. You can use AppSec Agent in three ways: Path| Best for| Get started ---|---|--- CLI agent-run| Trying agents from your terminal| Getting started npm library| Building your own app or...

awesome-appsec-interview

Awesome AppSec Interview A curated list of resources, practice questions, and study materials to help you prepare for Application Security Engineer interviews, organized by interview type. Contents Interview Overview Secure Code Review Threat Modeling Coding & Scripting Scenario-Based Interviews...

cumulus

OWASP Cumulus - Threat modeling the clouds Cumulus is the easy way to bring security into cloud and devOps teams. As a variant of the card game Elevation of Privilege it follows the idea to threat model a system via gamification. This lightweight and low-barrier approach helps you find threats to...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

Kaspersky_CVE-2024-3094

Security Review: CVE-2024-3094 XZ Utils Backdoor Author: Sushin Ivan Date: March 2026 1. Project Description This repository contains the results of a full security review of the vulnerability CVE-2024-3094 Supply Chain Attack in the XZ Utils library. Objective: Conduct threat analysis Threat...

threat-model-cookbook

OWASP Threat Model Cookbook Project This project is about creating and publishing threat model examples. They can be in the form of code, graphical or textual representations. The models will use diverse technologies, methodologies and techniques. You can learn from those models, use them a base ...

drawio-threatmodeling

Draw.io libraries for threat modeling This is a collection of custom libraries to turn the free and cross-platform Draw.io diagramming application into the perfect tool for threat modeling. Data Flow Diagrams Data Flow Diagramming is a simple diagramming technique used to gain an understanding of...

pytm

pytm: Un marco Pythonico para modelado de amenazas Introducción El modelado de amenazas tradicional a menudo llega tarde a la fiesta, o a veces no llega en absoluto. Además, crear flujos de datos e informes manuales puede ser extremadamente lento. El objetivo de pytm es desplazar el modelado de...

threat-modeling-playbook

Intro We aim to improve product and software security with our new threat modeling playbook. We consider threat modeling as a foundational activity to improve your software assurance. We are convinced that a good threat modeling practice will measurably decrease security issues of delivered...

threatspec

threatspec - modelado de amenazas continuo, a través del código Threatspec es un proyecto de código abierto que tiene como objetivo cerrar la brecha entre el desarrollo y la seguridad al incorporar el proceso de modelado de amenazas más profundamente en el proceso de desarrollo. Esto se logra...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon es una aplicación gratuita, de código abierto y multiplataforma de modelado de amenazas que incluye diagramación del sistema y un motor de reglas para generar automáticamente amenazas/mitigaciones. Es un Proyecto Incubador de OWASP. El enfoque del proyecto está e...

Threat_Model_Examples

Threat Model Examples This repository contains various threat model examples for different technologies and systems. These resources provide illustrative examples of threat models across different domains, helping security professionals, developers, and researchers better understand how threat...