Threat-model a system (STRIDE)
Systematically identifies threats to a system and the controls to mitigate them.
The prompt
Create a threat model for this system using STRIDE.
System description: [PASTE design doc, architecture diagram description, or overview]
Assets that matter: [data, money, availability, reputation]
Users and trust levels: [anonymous, customers, admins, services]
Existing controls: [auth, encryption, logging, WAF…]
Deliver:
1. Assets and trust boundaries.
2. Data flows — mark those that cross trust boundaries.
3. Threat table per element: | Element | STRIDE category (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) | Threat | Likelihood | Impact | Existing control | Recommended mitigation |
4. The top 5 risks to address first.
5. Assumptions and open questions.
Be specific to this system — avoid generic threats that don't apply.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Software Development prompts
What to fill in
- data, money, availability, reputation
- anonymous, customers, admins, services
- auth, encryption, logging, WAF…
How this prompt is built
This prompt follows the RTF structure (Role, Task, Format). RTF tells the model who to be, what to do and what shape the answer should take. It is the quickest structure that still gives noticeably better results than a bare request.
Related prompts
- Explain what a piece of code doesPlain-language walkthrough of unfamiliar code: purpose, flow, key parts, and gotchas.
- Understand a new codebase quicklyMaps an unfamiliar repository: architecture, key flows, conventions, and where to start.
- Audit a codebase for bugs, risks, and tech debtA systematic review of a repository with prioritized findings and a remediation plan.
- Refactor code to be cleaner and easier to maintainImproves structure, naming, and design without changing behavior.