Threat modelling for product teams that are not security firms
A lightweight process engineering and product can run together in one afternoon.
Technical deep dive
Security backlogs grow faster when teams only react to pen-test reports. A short threat-modelling habit catches issues earlier — and cheaper.
Sketch the system
Draw trust boundaries: browser, mobile app, API, admin panel, third-party services, database. Label what each boundary is allowed to do. Surprises on this diagram are already findings.
Ask four questions per feature
- Who can abuse this if authenticated?
- Who can abuse this if not authenticated?
- What happens if this dependency lies or is compromised?
- What sensitive data is stored, logged, or exported?
Prioritise by blast radius
Auth bypasses, mass data export, and privilege escalation beat cosmetic issues. Fix the paths that unlock everything else first.
Security is not a phase at the end. It is a filter on product decisions.
Run this review when you add a new role, a new integration, or a new data export — not only before launch week.
