Every threat from a threat modeling session needs one of four responses: mitigate it, eliminate it, transfer it or accept it. The OWASP Threat Modeling Cheat Sheet defines each. Choosing one explicitly, and writing it down, is what turns a list of worries into a plan.
The four options
Mitigate means reducing the likelihood that the threat succeeds. Adding rate limiting to a login endpoint mitigates credential stuffing. The threat still exists, but it is harder.
Eliminate means removing the feature or component that creates the threat. If nobody uses a bulk export endpoint, deleting it removes every threat attached to it. Elimination is the strongest response and the least used.
Transfer means shifting responsibility to another party. The cheat sheet is careful to note that transfer does not itself reduce risk. Moving card handling to a payment processor changes who is responsible for part of the problem, but your system can still be abused in other ways.
Accept means leaving the threat unaddressed because of business constraints. This is a legitimate choice when cost outweighs impact, as long as someone with authority signs off.
How to choose
Start from the top of the list and ask whether you can eliminate. Features that were added "just in case" are good candidates. If you cannot, ask whether a mitigation is cheap and reliable. If the threat is rare and the damage small, accepting may be right.
Transfer deserves skepticism. Ask what the other party actually promises, and what you still own if they fail.
Write the response as a requirement
The cheat sheet says to turn agreed mitigations into security requirements and keep them current. A good requirement is testable: "Login attempts are limited to a fixed number per account per window, and the limit is covered by an integration test." A bad one is vague: "Login must be secure."
Record accepted risks properly
For each accepted threat, record:
- Who accepted it, by name and role.
- Why, in one or two sentences.
- When it will be reviewed.
- What would change the decision, such as a new customer segment or a new data type.
The OWASP abuse case page makes the same point: risk accepted items need a rationale comment.
Common mistakes
- Marking everything mitigate without a ticket or a test.
- Using accept to mean "we ran out of time."
- Treating transfer as the end of the story.
An example across all four
An upload feature lets users attach files. Eliminate: remove the feature if usage is near zero. Mitigate: restrict types and sizes, scan content and store files outside the web root. Transfer: hand storage and scanning to a managed service, knowing you still own how files are used. Accept: leave a low risk edge case, such as slow uploads from one address, because the cost to fix exceeds the harm. Seeing all four side by side often shows that the first answer is not the only one.
Quick check
Which response is strongest?
Eliminate. A removed feature cannot be attacked. It is also the hardest to agree on, because someone usually wants the feature.
Does buying insurance count as a response?
It is a form of transfer. It does not reduce the chance of an attack, so keep other responses in place.
Sources
Last reviewed: 19 October 2026.
