Threat Model
ELI5 - The Vibe Check
A threat model is you sitting down before writing a line of code and asking who might want to attack this thing, what could they actually do, and where you're weakest. It's the security equivalent of walking through a house before buying it and checking every window and door, instead of waiting for a break-in to find out which one wasn't locked.
Real Talk
Threat modeling is a structured process for identifying potential threats, attack surfaces, and mitigations for a system before or during design. It typically maps data flows, trust boundaries, and assets, then reasons through what could go wrong at each boundary, feeding directly into design decisions and test cases.
When You'll Hear This
"We do a threat model before any new service touches customer payment data." / "The threat model flagged that the webhook endpoint had no signature verification."
Related Terms
Defense in Depth
Defense in Depth means layering multiple security measures so if one fails, others catch the threat.
OWASP Top 10
The OWASP Top 10 is the security industry's greatest hits of web vulnerabilities — the 10 most common, dangerous ways apps get hacked.
Penetration Testing
Penetration testing (pentesting) is hiring ethical hackers to try to break into your own systems before the real bad guys do.
Security Audit
A security audit is a systematic review of your code, infrastructure, and processes to find security weaknesses.
Zero Trust
Zero trust means 'never trust, always verify' — even if a request comes from inside your network.