🛡️ Security Education · 10 Modules
Learn Threat Modeling from the Ground Up
A complete teaching guide covering threat modeling fundamentals through cloud and AI agentic systems. Built for instructors teaching live sessions and students studying independently.
10
Modules
6+
Architecture Types
30+
Diagrams
20+
Exercises
?What Is This Guide?
Threat modeling is the practice of systematically identifying, analyzing, and mitigating security threats before they become real attacks. This guide teaches you how to do it — from a blank whiteboard to production-grade architectures.
Structured Learning
10 progressive modules from basics to advanced, each building on the last
Live Teaching Mode
Press "Present" on any page for a clean slide-by-slide classroom view
Real Architectures
Covers web apps, APIs, microservices, cloud (AWS/GCP/Azure), and AI agents
Interactive Exercises
Quizzes, threat identification tasks, and a full capstone project
Practitioner Resources
Looking for templates for your own software projects? Access our standalone Threat Model Template or printable STRIDE Cheat Sheet directly in the repository!
Part 1 — Foundations
Module 01
What is Threat Modeling?
The "why" behind threat modeling, its history, and how it fits in the security development lifecycle (SDL).
Module 02
Core Concepts
Assets, threats, vulnerabilities, risk, attack surfaces — the vocabulary every threat modeler must know.
Module 03
STRIDE Framework
The most widely-used threat categorization framework — Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege.
Module 04
The Threat Modeling Process
Step-by-step walkthrough: scope, data flow diagrams (DFDs), threat enumeration, risk scoring, and mitigation planning.
Part 2 — Application Threat Modeling
Module 05
Basic Applications
Threat model a simple login/CRUD app end to end. Authentication, session management, database access.
Module 06
Web Applications & APIs
Multi-tier web apps, REST APIs, OAuth 2.0 flows, OWASP Top 10 mapping, and microservices threats.
Part 3 — Modern Architectures
Module 07
Cloud Architecture
Shared responsibility, IAM threats, data at rest/transit, containers, serverless, cloud-native attack patterns.
Module 08
AI & Agentic Systems
LLM-based agents, prompt injection, tool misuse, multi-agent orchestration threats, and AI supply chain risks.