# Threat-model a system (STRIDE)

Systematically identifies threats to a system and the controls to mitigate them.

- Topic: Software Development
- Framework: RTF
- Level: Standard
- Tags: Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/threat-model-a-system-stride

## Prompt

```text
Create a threat model for this system using STRIDE.

**System description:** [PASTE design doc, architecture diagram description, or overview]
**Assets that matter:** [data, money, availability, reputation]
**Users and trust levels:** [anonymous, customers, admins, services]
**Existing controls:** [auth, encryption, logging, WAF…]

Deliver:
1. Assets and trust boundaries.
2. Data flows — mark those that cross trust boundaries.
3. Threat table per element: | Element | STRIDE category (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) | Threat | Likelihood | Impact | Existing control | Recommended mitigation |
4. The top 5 risks to address first.
5. Assumptions and open questions.

Be specific to this system — avoid generic threats that don't apply.
```

## What to fill in

- data, money, availability, reputation
- anonymous, customers, admins, services
- auth, encryption, logging, WAF…

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.