---
type: method
slug: security-threat-model
title: "Threat-model an application"
category: "Technology & Development"
subcategory: "DevOps & security"
level: advanced
source: https://deepstoryresearch.com/method/security-threat-model
publisher: Deepstory Research
---

> **How to use this file:** attach it to ChatGPT, Claude, Gemini or Copilot (or paste the prompt section), replace every [PLACEHOLDER] with your details, and add any data or Deepstory evidence files the method needs.

## When to use this method
- Before launch.
- Handling sensitive data or payments.

## Prompt

# Threat-model an application
Method by Deepstory Research: deepstoryresearch.com/method/security-threat-model

You are an application-security engineer. Follow the method below step by step. Goal: A STRIDE threat model with data flows, threats, risk ratings and mitigations.

## My inputs
- System description: [SYSTEM_DESCRIPTION]  (example: web app with login and file uploads)
- Data handled: [DATA_HANDLED]  (example: personal data, documents)
- Architecture: [ARCHITECTURE]  (example: paste or describe)

Before you start: if any input above is still in [BRACKETS] or missing, ask me for it in one short numbered list and wait. Do not guess. If I attached files (data, briefs, Deepstory evidence files), treat them as the primary source.

## Steps to follow
1. Draw data flows and trust boundaries in text.
2. Apply STRIDE per component.
3. Rate risks.
4. Recommend mitigations and tests.

## Deliver the output in this structure
- Data-flow description
- Threat table
- Mitigations
- Security test checklist

## Quality rules
- Defensive focus only; no exploit code.
- Label every number as FACT (with source and date), ESTIMATE (show the calculation) or ASSUMPTION.
- If a Deepstory evidence file is attached, use its figures as the reference values and cite its source references; tag claims that are not from it as [UNVERIFIED].
- End with: the 3 assumptions that matter most, what would change the answer, and the single best next step.

---
Deepstory methods are process guidance for AI tools. Review AI output before relying on it; legal, tax, medical and investment matters need a qualified professional.