MethodTechnology & DevelopmentDevOps & securityAdvanced

Threat-model an application

A STRIDE threat model with data flows, threats, risk ratings and mitigations.

This is a practical, copy-paste process for before launch.. Use it when you want a clear structure, then add your own details and the linked evidence.

Published by Deepstory Research. Reviewed Sep 2026.

How to use this method

1. Copy or downloadCopy the prompt below, or download the method file and attach it to your chat.
2. Paste into any AIChatGPT, Claude, Gemini or Copilot. Replace each [PLACEHOLDER] with your details, or let the AI ask you.
3. Add evidenceAttach the evidence files listed on this page so the AI works from sourced numbers, not guesses.

The prompt

Paste it as-is. The AI will ask for anything still in [BRACKETS].

Download .md

# Threat-model an application
Method by Deepstory Research: deepstoryresearch.com/method/security-threat-model

You are an application-security engineer. Follow the method below step by step. Goal: A STRIDE threat model with data flows, threats, risk ratings and mitigations.

## My inputs
- System description: [SYSTEM_DESCRIPTION]  (example: web app with login and file uploads)
- Data handled: [DATA_HANDLED]  (example: personal data, documents)
- Architecture: [ARCHITECTURE]  (example: paste or describe)

Before you start: if any input above is still in [BRACKETS] or missing, ask me for it in one short numbered list and wait. Do not guess. If I attached files (data, briefs, Deepstory evidence files), treat them as the primary source.

## Steps to follow
1. Draw data flows and trust boundaries in text.
2. Apply STRIDE per component.
3. Rate risks.
4. Recommend mitigations and tests.

## Deliver the output in this structure
- Data-flow description
- Threat table
- Mitigations
- Security test checklist

## Quality rules
- Defensive focus only; no exploit code.
- Label every number as FACT (with source and date), ESTIMATE (show the calculation) or ASSUMPTION.
- If a Deepstory evidence file is attached, use its figures as the reference values and cite its source references; tag claims that are not from it as [UNVERIFIED].
- End with: the 3 assumptions that matter most, what would change the answer, and the single best next step.

What you need to give the AI

Input	Placeholder	Example
System description	[SYSTEM_DESCRIPTION]	web app with login and file uploads
Data handled	[DATA_HANDLED]	personal data, documents
Architecture	[ARCHITECTURE]	paste or describe

Use it when

Before launch.
Handling sensitive data or payments.

What you get

Data-flow description
Threat table
Mitigations
Security test checklist

The procedure, step by step

Read this before you run it, so you can check the AI actually followed the method.

1
Draw data flows and trust boundaries in text.
2
Apply STRIDE per component.
3
Rate risks.
4
Recommend mitigations and tests.

Quality checks built into the prompt

• Defensive focus only; no exploit code.
• Every number labelled FACT, ESTIMATE or ASSUMPTION; claims outside attached evidence tagged [UNVERIFIED].

Evidence for this method

This method runs on your own material: your files, brief or code. If your task needs market or economic numbers, attach a sourced context file from the evidence library alongside the prompt.

Browse evidence

Run next

Methods that chain well after this one.

Legal, Risk & ComplianceCheck data-privacy compliance gapsA data map and gap analysis against GDPR / DPDP / PDPL principles with remediation steps.Technology & DevelopmentSet up a CI/CD pipelineA pipeline definition with build, test, security scan, preview and deploy stages.

Deepstory methods are process guidance for AI tools. Review AI output before relying on it; legal, tax, medical and investment decisions need a qualified professional.