Treat it as a vulnerability and make a recorded decision: mitigate it, eliminate the cause, transfer the risk, or accept it with an owner and a reason. The OWASP Threat Modeling Process page says threats with no countermeasures are treated as vulnerabilities, so they must not sit unresolved on the list.
The four responses
| Response | What it means | Example |
|---|---|---|
| Mitigate | Reduce likelihood or impact | Add rate limiting to a login endpoint |
| Eliminate | Remove the cause | Stop storing a card number you never needed |
| Transfer | Move the risk to another party | Use a payment provider for card data, or buy insurance |
| Accept | Live with it knowingly | A low rated threat on an internal tool |
These four options appear in the OWASP cheat sheet and the OWASP process page.
A decision flow
- Can we remove the feature or data that causes it? If yes, eliminate. Nothing beats not having the problem.
- Is there a known control that fits? If yes, mitigate, and write the control as a requirement.
- Can another party carry the risk better than us? If yes, transfer, but remember you still own the relationship and the residual exposure.
- Is the rating low enough and the cost high enough that we would rather accept? If yes, accept, and record why.
If none applies, escalate: the threat needs a design discussion or someone senior to own it.
Be careful with transfer and accept
Transfer does not make a risk disappear. If you hand card data to a provider, you now depend on that provider. Check what they cover and what you still have to do.
Accept must be explicit. The OWASP cheat sheet says to document the reasoning behind accepted residual risk. Add three things: who accepted it, the date, and a date to look again.
Track the status
The OWASP process page places each threat as non-mitigated, partially mitigated or fully mitigated. A threat that has a response but no finished work is partially mitigated. Link it to a ticket so the status moves.
What good looks like at the end of a session
Every threat has a response, an owner and a next step. No row says "TBD" without a date. The remaining open items are few and named.
See also four responses to a threat for more on each option.
Try it yourself
Click through it at your own pace, or open it full screen. Click through it and look at how a policy gate blocks or allows a change, one way to enforce a mitigation decision.
Quick check
Can I just leave a low rated threat on the list?
Only with an explicit response. Leaving it undecided is not accepting it. Record accept, the reason and who agreed.
Does transferring risk remove my responsibility?
No. It moves some exposure to another party, but you still depend on them. Record what they cover and what remains yours.
A note on tooling
Safeguard covers policy gates and guardrails that can enforce a decision in pull requests, and autonomous remediation with fix PRs for dependency issues, which is off by default and starts on Manual. Try the free scan.
Sources
Last reviewed: 19 October 2026.
