Start with STRIDE if you need a general design review. Use LINDDUN when privacy is the main worry, attack trees when you care about one attacker goal, and PASTA when business objectives must drive the analysis. OWASP advises choosing by scope, not stacking methods to look thorough.
What each method is
- STRIDE is a mnemonic for six threat types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege. Each maps to a security property such as authentication, integrity or availability.
- LINDDUN is a privacy method covering linking, identifying, non-repudiation, detecting, data disclosure, unawareness and non-compliance.
- Attack trees start from an attacker's goal and map the paths that could reach it.
- PASTA connects business objectives and technical requirements to application threats.
- Misuse and abuse cases examine abuse of valid workflows, such as steps done out of order, repeated or at the same time.
- OCTAVE assesses organization-wide risk to critical assets, and VAST keeps separate application and operational models across many teams.
These descriptions follow the OWASP Threat Modeling Cheat Sheet.
Decision table
| Your situation | Start with | Why |
|---|---|---|
| New feature, small team, first model | STRIDE | Six prompts, easy to teach |
| System handles personal data | LINDDUN, plus STRIDE | Covers privacy threats STRIDE does not name |
| One scary outcome, such as account takeover | Attack tree | Shows every path to the goal |
| Workflow can be gamed, like a discount or refund | Abuse cases | Focuses on valid steps used badly |
| Executives want risk tied to business goals | PASTA | Starts from objectives |
| Many teams, shared platform | VAST or OCTAVE style reviews | Built for scale and organization-wide view |
How to combine without overdoing it
A common, light pattern: draw a data flow diagram, walk each element with STRIDE, then draw one attack tree for the single worst outcome. Add LINDDUN only if personal data is in scope. That is three techniques with a clear job each.
The OWASP cheat sheet says to select techniques based on scope and not to add them only to appear thorough. If a method does not produce a decision, drop it.
Tools that support the methods
OWASP Threat Dragon supports STRIDE, LINDDUN, CIA, DIE and PLOT4ai in its diagrams. Pick the method first and the tool second, so the tool does not decide your analysis for you.
Quick check
Is STRIDE enough on its own?
For many features, yes. It finds a wide set of design threats. Add LINDDUN when personal data matters, and abuse cases when the risk is in how a valid workflow can be misused.
Do I need all of them?
No. Using more methods does not make a model better. Pick the smallest set that answers what can go wrong for this system.
A note on tooling
Methods guide design. Once code exists, Safeguard covers checks such as dependency scanning, SBOMs and policy gates in pull requests. There is a free scan if you want a quick look at a repository.
Sources
Last reviewed: 19 October 2026.
