The Threat Modeling Manifesto is a short public statement from a working group of practitioners. It sets five values, four principles and four anti-patterns for threat modeling. In one line: do it early and often, with people talking to each other, and aim for fixed design problems, not paperwork.
The five values
The manifesto states what it values more, "while still valuing the right":
- Finding and fixing design issues over checkbox compliance
- People and collaboration over processes, methodologies and tools
- A journey of understanding over a single security or privacy snapshot
- Doing threat modeling over talking about it
- Continuous refinement over a single delivery
The four principles
- Improve security and privacy through early, frequent analysis.
- Align with the organization's development practices, updating the model in small, manageable iterations.
- Make outcomes valuable to stakeholders.
- Use dialog to build shared understanding, with documents recording it and enabling measurement.
The four anti-patterns
| Anti-pattern | What it looks like | A fix |
|---|---|---|
| Hero Threat Modeler | One expert does all the models | Rotate the facilitator and coach others |
| Admiration for the Problem | Long threat lists, no action | End every session with owners and tickets |
| Tendency to Overfocus | Lost in one asset, adversary or technique | Zoom out to the whole data flow diagram |
| Perfect Representation | Waiting for the one correct diagram | Allow several views of the same system |
How a team can apply it this sprint
Make it small. Model one feature or one change, not the whole product. This follows the principle of small, manageable iterations.
Keep the output useful. Each threat should end up as a requirement, a test, a ticket or a recorded decision to accept. A list nobody acts on is the second anti-pattern.
Treat the model as a living document. Store the diagram where the team edits it, and update it when the design changes.
Check the human side. If the same person runs every session, the first anti-pattern is already at work.
What the manifesto does not do
It does not prescribe a method, a tool or a schedule. It is deliberately method neutral. For method choices, use a decision guide such as which threat modeling method fits. The page itself does not state a publication date, so check the site if you need to cite one.
Quick check
Is the manifesto a standard I can be audited against?
It is a statement of values and principles from a working group, not a certification or an audit standard. Use it as a guide for how to run the practice.
Who wrote it?
The site lists a working group that includes Zoe Braiterman, Adam Shostack, Jonathan Marcil, Kim Wuyts, Izar Tarandach and others. See the page for the full list.
A note on tooling
The manifesto is about design. Safeguard works later in the lifecycle, with dependency scanning, SBOMs, reachability analysis and policy gates. A free scan covers a repository in minutes.
Sources
Last reviewed: 19 October 2026.
