A usable threat model fits on one page: what the system is, a diagram, a table of threats with a response and owner for each, and the reasoning for anything accepted. OWASP guidance asks for exactly that: an updatable diagram, a threat list, a control list and recorded decisions.
What the sources ask you to keep
The OWASP Threat Modeling Cheat Sheet says to:
- Save diagrams in a form the team can update.
- Record which components, data flows or trust boundaries each threat affects.
- Document each threat's response and the reasoning behind accepted residual risk.
- Store artifacts so people with a need to know can access them.
The OWASP Threat Modeling Process page adds that a finished review confirms records exist for a diagram, a threat list and a control list. Its sample model also names a document owner, participants and a reviewer.
The template
Copy this into a page in your repository.
1. Header. System or feature name, document owner, participants, reviewer, date, and the version of the design it describes.
2. Scope. One paragraph on what is in and what is out. List the main assets, such as customer data or signing keys.
3. Diagram. A link or embedded data flow diagram with trust boundaries marked. See drawing one in Mermaid.
4. Threat table.
| ID | Where it applies | Threat | Rating | Response | Owner | Status | Test or ticket |
|---|---|---|---|---|---|---|---|
| T1 | Login endpoint | Credential stuffing | High | Mitigate: rate limit, MFA | Name | Partially mitigated | Link |
| T2 | Upload storage | Public guessable URLs | Medium | Mitigate | Name | Non-mitigated | Link |
Responses use the four options named by OWASP: mitigate, eliminate, transfer or accept.
5. Accepted risks. For each, the reason, who accepted it and when to look again.
6. Open questions. What the group could not answer.
7. Review notes. Whether the diagram is accurate, all threats are identified, responses are agreed, mitigations reduce risk to an acceptable level, and mitigations are testable. These are the OWASP review checks.
Keeping it to one page
If the table grows past about a page, split by component. A long list nobody reads is the Admiration for the Problem anti-pattern from the Threat Modeling Manifesto. Short, current and linked to tickets beats long and stale.
Try it yourself
Click through it at your own pace, or open it full screen. Click through it and see how one piece of evidence maps to several framework controls.
Quick check
Should the threat model live in a wiki or in the repository?
The sources only say to store it in a form the team can update and where the right people can reach it. A file in the repository gets reviewed with design changes, which helps keep it current.
Do I need to record threats I decided to accept?
Yes. OWASP says to document the reasoning behind accepted residual risk, so a later reader can understand and challenge the decision.
A note on tooling
Safeguard covers compliance and evidence automation, which can hold documents like this alongside other control evidence. For code, try the free scan.
Sources
Last reviewed: 19 October 2026.
