Threat model documents

Name: Threat model documents
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Identifies populated threat model documents (STRIDE, PASTA, attack trees) that enumerate threats against a named system: threat IDs, STRIDE category rows and trust-boundary / data-flow elements. "STRIDE" is only recognised in threat-model context, not as the English word "stride".

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: threat-model wording is discovery-only; enforcement requires threat IDs, STRIDE rows or model elements, and 85 adds a second structure and treatment context.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:threat\s+model(?:s|ling|ing)?(?:\s+(?:document|report|workshop|review|assessment|diagram))?|STRIDE\s+(?:analysis|threat\s+model(?:ling|ing)?|categor(?:y|ies)|assessment|review|model)|attack\s+trees?|PASTA\s+threat\s+model(?:ling|ing)?|trust\s+boundar(?:y|ies)\s+(?:diagram|analysis))\b

Corroborative evidence keywords

mitigation, residual risk, attack vector, security control

Proximity: 300 characters

Should match

Threat model - Rates payment gateway (v1.3, reviewed 02/09/2026) Trust boundary: public internet to pay-gw01.corp.example.internal (DMZ) Data flow: DF-04 card token from web portal to payments API Threat ID: T-07 Spoofing: attacker replays a captured session token against the payments API Threat ID: T-08 Tampering: amount parameter altered in transit between portal and gateway Mitigation: mutual TLS and signed payment requests; residual risk: low — High tier (85) - threat IDs, STRIDE rows and trust boundary/data flow elements with mitigation and residual risk
STRIDE analysis for the HR self-service portal - Repudiation: managers can approve leave without an audit record. — Medium tier (75) - STRIDE category row only
Threat modelling workshop notes - Entry point: public booking API behind the web application firewall. — Medium tier (75) - model element only
Please attach the threat model to the architecture review submission. — Discovery tier (65) - threat model wording only

Should not match

She lengthened her stride on the final lap of the race. — English word stride is not a threat-model primary
The company made great strides in model accuracy this year. — Common English usage
Guidance note: teams should build a threat model early; STRIDE categories cover spoofing, tampering and repudiation. — Guidance text
Threat model template Threat ID: ____ Spoofing: ____ Trust boundary: ____ Mitigation: ____ — Blank template
Training course exercise: build a threat model for a made-up pizza shop; Spoofing: a customer pretends to be another customer. — Training framing with a STRIDE row must not enforce

Known false positives

Threat modelling guidance (OWASP, Microsoft) and training describe STRIDE categories, trust boundaries and data flows generically. Mitigation: Threat-model wording is discovery-only; enforcement needs populated threat rows or elements, and guidance/training/template framing is excluded.
The English word "stride". Mitigation: STRIDE is only matched when followed by analysis/threat model/categories/assessment/review/model.