Threat modeling helps a team identify and communicate plausible threats, affected people and assets, assumptions, possible responses, and risks that remain within a defined system boundary. It can inform design and risk decisions, but it does not implement protections, prove a system secure, or guarantee that attacks will fail. Here, SAL means NIST’s Security Assurance Levels: a vector for describing security requirements, not a threat-modeling method.
What does SAL mean?
NIST’s 2010 paper by James D. Gilsinn and Ragnar Schierholz, Security Assurance Levels: A Vector Approach to Describing Security Requirements, introduces Security Assurance Levels as a vector for describing the protection factor needed for a system. The vector approach matters: security consequences and circumstances vary, so a single number can be inadequate. As the authors put it, “The increased complexity of security systems makes compressing the protection factor down to a single number much more difficult.”
As an Amazon Associate I earn from qualifying purchases.
SAL therefore describes security requirements; it does not name a proprietary threat-modeling framework. A threat model is a separate analysis of a system’s possible threats, assumptions, responses, and residual risks. The two can be considered together, but they answer different questions.
Recommended Free Tools
What does threat modeling defend against?
Threat modeling does not block an attack directly. It helps a team notice and reason about security and privacy concerns early enough to influence requirements and design. The W3C Threat Modeling Guide also calls attention to affected stakeholders and socio-technical harms; OWASP’s overview recognizes that threats can be malicious or incidental.
#1 Best Overall
A useful model makes the system under consideration clear enough to support practical questions: what is being built, who may be affected, what could go wrong, what response is appropriate, and whether the analysis is adequate for the current stage? A diagram or other representation should show relevant actors, system components, data flows, trust boundaries, and assumptions. The team can revisit it as the design changes.
For example, Microsoft’s STRIDE-style threat prompts include asking how an attacker might alter authentication data, disclose user profile data, or deny access to a profile database. These are questions to investigate, not evidence that a specific system is protected.
What does threat modeling not defend against?
It does not guarantee security
A model records analysis and decisions; it is not a security control. The team must still implement chosen mitigations and evaluate whether they work. A completed model cannot establish that attacks will not succeed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
It does not need to enumerate every imaginable threat
Trying to capture everything can make a model harder to write, review, and maintain. The W3C guide says, “A threat model does not need to be exhaustive to be useful.” The aim is to capture enough important threats for the system and stage being considered, then update the analysis when relevant conditions change.
It does not automatically cover everything outside its boundary
Implementation decisions, deployment conditions, dependencies, and behavior elsewhere in an ecosystem can create risks that a specification or model does not directly control. State the boundary and assumptions, identify who owns responses, and record residual threats rather than treating unexamined areas as safe.
It is not itself a risk-scoring exercise
A threat model can inform risk assessment and management, but scoring is optional. The W3C guide’s approach is to use scoring when it helps a decision, not to assume that every model needs a numerical rating.
Rank #4
It does not replace code review
Threat modeling and security code review serve complementary purposes. OWASP’s historical process guidance explicitly describes threat modeling as complementing code review; neither should be treated as a substitute for the other.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteHow to use threat modeling in practice
OWASP organizes the process around four questions. Treat the answers as working analysis: the model should evolve with the system, rather than become a one-time assurance label.
- What are we working on? Define the system boundary, relevant components and actors, important data flows, trust boundaries, and assumptions. Be clear about what the analysis excludes.
- What can go wrong? Identify plausible security and privacy threats using a technique suited to the system. Consider who could be affected and whether harms might be incidental as well as deliberate.
- What are we going to do about it? Choose mitigations or another explicit response. Assign responsibility where possible, and record risks the team accepts or cannot address within the current boundary.
- Did we do a good job? Check whether the analysis is adequate for its stage and purpose. Revisit it after significant features, incidents, or architectural and infrastructure changes.
OWASP recommends starting early and returning to the model as the system evolves. That makes the analysis more useful for design decisions, while keeping its limits visible.
How to compare SAL with a threat model
Do not compare them as if they were competing scores or interchangeable methods. SAL’s vector describes security requirements; a threat model examines plausible threats and responses in a defined context. When comparing a SAL description with a threat model—or comparing two threat-modeling approaches—check what each actually covers:
Quick Recap
- Boundary and scope: Which system, components, actors, and conditions are included?
- Threats and assurance dimensions: What threats, harms, or security requirements are considered?
- Assumptions and ownership: What must be true, and who is responsible for action?
- Responses: Which mitigations or other risk responses are selected?
- Residual risk: What remains unresolved or outside the analysis?
- Decision use: Does the result inform a separate risk or design decision, and how?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
