Whiteboard, spreadsheet or tool: how to choose a threat modeling approach

Start with a whiteboard, move to a spreadsheet when you need a record, and adopt a dedicated tool when you have many models to keep current. OWASP Threat Dragon is one free option: it draws diagrams, lists threats per element, and supports STRIDE and LINDDUN among other frameworks.

What the method needs to do

Whatever you use, it must help you do four things: model the system, list threats, record a response for each, and keep the result up to date. The Threat Modeling Manifesto values people and collaboration over tools, so pick the lightest thing that gets those four jobs done.

Option 1: Whiteboard and photos

Good for: first sessions, small teams, remote sessions with a shared canvas.

Strengths: zero setup. Everyone can draw. Conversation stays in front.

Weaknesses: the result lives in a photo. Hard to search, diff or review. It goes stale quickly.

Tip: nominate a scribe to transcribe the threats and decisions into tickets the same day.

Option 2: Spreadsheet or document

Good for: teams with a handful of models who want a record without new tooling.

Strengths: familiar, easy to share, simple columns for threat, STRIDE category, rating, response, owner, ticket link.

Weaknesses: the diagram and the threat list drift apart. No link between a box on the diagram and its threats.

Tip: store the file next to the design document and name elements consistently so people can match them.

Option 3: A dedicated tool

OWASP Threat Dragon is open source under the Apache License 2.0. Per its project page, it lets you draw threat model diagrams, record threats and mitigations for each element, and use a rule engine that suggests threats and mitigations. It runs as a desktop app or a self hosted web app, and supports STRIDE, LINDDUN, CIA, DIE and PLOT4ai.

Good for: teams with many services, a need to review models regularly, or a requirement to show evidence.

Strengths: diagram and threats are linked. Suggested threats act as prompts.

Weaknesses: a learning curve, and the risk that a tool becomes the point of the exercise. The Manifesto lists admiration for the problem and perfect representation as anti patterns, and a polished tool can feed both.

A simple way to choose

Ask three questions.

1. How many systems do we model this year? One to three: whiteboard plus a document. More: consider a tool.
2. Who must review the results? If auditors or customers ask, a tool or structured file is easier to show.
3. Who will keep it current? Whoever owns the process picks the format.

Keep the model near the code

Models rot when they sit in a separate space nobody visits. Keep the file in the repository, link it from the design document, and add a checklist line in pull request templates for architecture changes.

Quick check

Sources

• OWASP Threat Dragon
• Threat Modeling Manifesto

Last reviewed: 19 October 2026.