Threat modeling is how development teams find out what can go wrong with a system before an attacker does, and decide what to do about it. This site is the companion to our book on the subject, and a place where we keep writing about threat modeling practice, tools, and its collision with AI and LLMs.

Did you ever ask yourself what threat modeling is, how it can help you bake security into your system, and what your role as a development team member is in the whole process?

If so, this is the book for you. Available at Amazon, Barnes&Noble and other book sellers.

Other sources of threat modeling wisdom:

• Check out the Threat Modeling Manifesto.

• These extensive lists of resources:

  • https://github.com/arnepadmos/threats
  • https://github.com/hysnsec/awesome-threat-modelling
• The #threat-modeling channel at the OWASP Slack
• ThreatModelingConnect, the community for threat modeling!
• https://github.com/OWASP/pytm
• https://github.com/izar/continuous-threat-modeling
• https://shostack.org/blog
• https://www.toreon.com/tmi-threat-modeling/

We also have some of our ongoing writings here:

• Team Werewolves Wins!
  Apr 9, 2026
  AI won't replace human threat modelers — garbage in, garbage out still applies, and adversarial thinking stays a deeply human skill.
• A Dragon and Python walk into an OWASP card game...
  Sep 17, 2025
  A tour of four approachable OWASP threat modeling tools — Threat Dragon, pyTM, Cornucopia, and Cumulus — and who each is best suited for.
• Would Asimov use ChatGPT ? A Threat Modeler's Take on AI Ethics
  Sep 1, 2025
  Asimov's Three Laws of Robotics as a lens for thinking about AI ethics and safety today, from a threat modeler's perspective.
• CTM and LLMs - Hitting the Wall (In a Good Way)
  Aug 27, 2025
  Using LLMs inside Continuous Threat Modeling is like hitting tennis balls against a wall — not a replacement for the team, but a useful practice partner.
• Vibe Coding an the rise of PR-Fatigue
  Jul 14, 2025
  AI-generated code is piling up in pull requests faster than reviewers can scrutinize it, echoing the alert-fatigue problem security teams already know.
• Prompt Injection (Good God) What Is It Good For?
  Jun 4, 2025
  A closer, skeptical look at OWASP's definition of prompt injection and what its real-world impact actually is.
• Vibe Threat Modeling. No, really.
  Mar 31, 2025
  A tongue-in-cheek look at what "vibe threat modeling" would actually mean, and why intuition alone doesn't replace rigor.
• Zen Of Threat Modeling
  Aug 30, 2024
  Koan-style musings on threat modeling, security practice, and the mindset of the warrior monk of the CTM-Ryu school.
• Prompt Injection Should Not Be A Security Issue
  Jan 1, 2024
  Why treating prompt injection as an LLM security bug misses the point, and what threat modelers should focus on instead.