Model the system
A living picture of how data moves.
- Components, data stores and flows
- Trust boundaries drawn once and reused
- Import from existing diagrams
HashGo ยท Threat modeling
HashGo Threat Modeling
In development
See the attack before it is built.
HashGo Threat Modeling turns your architecture into a model of components, data flows and trust boundaries. It then lists the threats that follow from the design and the controls that answer them.
In development. This page describes what we are building. Features may change before release.
Capabilities
What Threat Modeling will do.
Architecture turned into components, flows and trust boundaries, with the threats that follow and the controls that answer them.
Threats from the design
Threats that come from your architecture, not a generic list.
- STRIDE-based threat generation
- Threats for AI features, APIs and third parties
- Severity from exposure and data sensitivity
From threat to ticket
Every threat ends with something a team can build.
- Mitigations tied to each threat
- Export to your issue tracker
- Re-check the model when the design changes
How it works
Four steps, start to finish.
Describe the system
Add components, data stores and the flows between them.
Mark boundaries
Show where trust changes, such as the internet edge or a third party.
Generate threats
Review threats derived from the design and rank them.
Plan mitigations
Turn each threat into a control and a ticket.
Coverage
What it covers.
- STRIDE
- LINDDUN
- PASTA
- Data flow diagrams
- Trust boundaries
- AI threats
What is threat modeling?
It is a structured way to ask what could go wrong with a system before it is built or changed, and what to do about it.
When should it happen?
At design time, and again whenever the architecture changes in a meaningful way.
Which methods are planned?
STRIDE first, with LINDDUN for privacy and PASTA for risk-centric reviews.
How does it work with other HashGo products?
Mitigations from the model are planned to be verified by HashGo SAST and DAST, and tracked as controls in HashGo GRC.
When will it be available?
It is in development. Write to us for early access.
Be first to try Threat Modeling.
Tell us about your environment and we will reach out when early access opens.
