🌍 Dev.to
Threat modeling for a team of six: the version that actually gets done
Most threat modeling advice is written for companies with a security team. If you are six engineers shipping a product, that advice reads as a list of reasons not to start.
STRIDE per data flow diagram element. Trust boundary enumeration. A DFD maintained as the architecture changes. Attack trees. It is all legitimate, and none of it survives contact with a team where the person who would run it is also on call this week.
So teams do the honest thing and skip it, and then the security ques...


