In threat modeling, an asset is what you protect, a threat is something that could go wrong, a vulnerability is a threat with no adequate countermeasure, and a countermeasure is a control that reduces the threat. Entry points and trust levels describe where and by whom the system can be touched.
Definitions
| Term | Plain meaning | Example |
|---|---|---|
| Asset | Something of value worth protecting | Customer records, signing keys, uptime |
| Entry point | Where data or control enters the system | A login form, an API route, a file upload |
| Exit point | Where data leaves | A report export, an email, a webhook |
| Trust level | How far a party is trusted | Anonymous visitor, customer, admin, internal service |
| Trust boundary | A line where trust level changes | Between the internet and the backend |
| Threat | A way an attacker could harm an asset | Someone reads another customer's record |
| Countermeasure | A control that reduces a threat | An access check on every record request |
| Vulnerability | A threat without a countermeasure that works | The record endpoint has no access check |
| Response | Your decision about a threat | Mitigate, eliminate, transfer or accept |
The OWASP Threat Modeling Process page lists entry and exit points, assets and trust levels as part of understanding the system, and says threats with no countermeasures are treated as vulnerabilities. The four responses (accept, eliminate, mitigate, transfer) appear on that page and in the OWASP cheat sheet.
Terms people mix up
Threat versus vulnerability. A threat is a possibility. A vulnerability is a flaw you can point at. In a model, an unmitigated threat becomes a vulnerability to fix.
Risk versus threat. Risk adds likelihood and impact. A threat is what could happen; risk is how much you should worry. See threat modeling versus risk assessment.
Mitigate versus eliminate. Mitigating makes a threat less likely or less harmful. Eliminating removes the feature or data that created it.
Worked example
Take a support portal. Assets: customer tickets. Entry point: the ticket search page. Trust levels: customer, support agent, admin. A threat: a customer changes the ticket ID in the URL and reads another customer's ticket. If the search page has no ownership check, that is a vulnerability. The countermeasure is a server side check that the ticket belongs to the caller. The test is a request for another customer's ticket ID that must be refused.
Why the vocabulary matters
When a group agrees on terms, discussion moves faster. The model also reads clearly to someone new, which helps the review step.
Quick check
Is every threat a vulnerability?
No. A threat becomes a vulnerability when no adequate countermeasure exists. Threats with working countermeasures stay on the list as mitigated.
What is the difference between accept and ignore?
Accepting is a recorded decision with a reason and an owner. Ignoring is silence. Only the first belongs in a good model.
A note on tooling
Safeguard covers the vulnerability side: dependency scanning, reachability analysis and zero day discovery, plus policy gates. Try the free scan.
Sources
Last reviewed: 19 October 2026.
