OWASP Cornucopia is a set of card game decks that helps development teams threat model web and mobile applications by playing cards that prompt attack ideas. It is aimed at whole agile teams and helps them turn security thinking into requirements and security focused user stories.
What it is
According to the project page, Cornucopia is a production OWASP project, at version 3.5 when we reviewed it. It comes as printable cards, online cards and an online game. The page says it was first used for developer training in August 2012, following SAFECode guidance on practical security stories for agile teams, and that it maps to standards such as ASVS, MASVS and SAMM. It uses a Creative Commons Attribution ShareAlike license.
Why a card game
A blank threat modeling session often stalls. People do not know where to start. Cards give each player a prompt, so the quiet developer has something specific to react to, and you hear ideas from outside the security group. It is also short and low tech, which makes it easy to try.
How a session can run
This is one workable format, not the one correct way to play.
- Choose one feature or one user story, not the whole system. A login change or a new file upload works well.
- Invite four to eight people: developers, a tester, a product owner and a champion if you have one.
- Draw a quick diagram on a whiteboard: who calls what, where data goes.
- Deal the cards. Each player says whether the card could apply to this feature and how.
- Record every plausible attack as a short note.
- Turn the top few notes into backlog items with acceptance checks.
- Close with a ten minute review of what to test first.
Allow 60 to 90 minutes. If it runs longer, narrow the feature.
Where it helps and where it does not
| Helps with | Does not replace |
|---|---|
| Getting a whole team thinking about abuse cases | A formal review of high risk architecture |
| Writing security user stories | Testing the finished code |
| Teaching the vocabulary of common flaws | Scanning dependencies and secrets |
| A cheap first threat model | Expert threat modeling for critical systems |
Making it stick
Run it again for the next feature, rotate the facilitator, and track whether the stories get built. If the output sits in a document no one reads, the session was entertainment. Link each story to a ticket.
Our post on a 60 minute developer threat modeling workshop shows a non card alternative.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning, which covers the parts a card game cannot see, such as vulnerable packages. You can try a free scan.
Quick check
Do we need a security expert to run it?
Not strictly, but a champion or security engineer helps judge which ideas are realistic. Pick a facilitator who has read the cards in advance.
Is Cornucopia free?
The project page lists a Creative Commons Attribution ShareAlike license. Check the current license on the project page before reuse.
Sources
Last reviewed: 19 October 2026.
