Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cyber Threat Modeling Is Going Open Source
Transcript
- Lucas: If these conversations are useful for what you're building or running, there's something I want to mention early. Luna: Go ahead. Lucas: We deliberately keep this show free of ads. No sponsors, no mid-roll interruptions. The only reason that works is because some listeners choose to support it directly. If that's something you'd like to do, the page is buy me a coffee dot com slash fexingo. That's it — no pressure, no perks, just a way to keep the conversation independent. Luna: Yeah, and it genuinely makes a difference. We don't have to shape episodes around what an advertiser wants. Lucas: Exactly. So let's get into today's topic: open-source threat modeling. A 2025 survey by the Cloud Security Alliance found that 42 percent of Fortune 500 security teams now use at least one open-source threat modeling tool. That's up from 18 percent in 2022. So the shift is real, and it's accelerating. Luna: I've seen that survey. What struck me was that the main driver wasn't cost savings — it was flexibility. Teams said proprietary tools were too rigid for their specific architecture. Lucas: Right. And threat modeling is inherently contextual. You're not just checking a box — you're mapping data flows, trust boundaries, and attack surfaces that are unique to your system. So if your tool forces you into a specific methodology, you end up fighting the tool instead of modeling the threat. Luna: Let's name some of the frameworks that are being adopted. OWASP Threat Dragon is probably the most visible. It's a free, open-source tool for creating threat model diagrams based on STRIDE. Lucas: STRIDE — Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege — that's the Microsoft-originated classification system. Threat Dragon lets you drag and drop components, assign threats per element, and generate reports. It's not as polished as something like IriusRisk, but it's free and it integrates with Git. Luna: And that Git integration is key. Security teams are embedding threat models directly into their repositories alongside code. So when a developer opens a pull request, they can see the associated threat model update in the same pipeline. Lucas: That's the DevSecOps ideal. But let's talk about the other big open-source player: the MITRE ATT&CK framework. It's not a tool per se — it's a knowledge base of adversary tactics and techniques. But teams are using it as the backbone for their threat models. They map each data flow to specific techniques an attacker might use. Luna: And there's a practical reason for that. If you're using ATT&CK, your threat model becomes directly comparable to real-world intrusion reports. You can say, 'We've mitigated 14 of the 18 techniques commonly used by ransomware groups in our industry.' That's a powerful metric for a CISO to present to the board. Lucas: It also helps with prioritization. Not all threats are equal. If you model a system and find it's vulnerable to a technique that's been used in three high-profile breaches this year, that moves up the remediation queue fast. Luna: Let's get concrete. Netflix open-sourced its own threat modeling framework called 'Threat Modeler' a couple of years ago. It's built on top of STRIDE and ATT&CK, and it automatically generates threat models from infrastructure as code templates. Lucas: Right. So if you define your AWS environment in Terraform, Netflix's tool parses that and says, 'Here are the likely threat vectors for this S3 bucket configuration.' That's huge for teams that are scaling fast and can't manually model every microservice. Luna: Spotify did something similar. They built a tool called 'Backstage' — originally for developer portals — but they added a security plugin that integrates threat modeling into the service catalog. So each service has a 'threat model health score' that degrades if the model isn't updated after a code change. Lucas: That's a clever way to enforce hygiene. But I want to push back on a risk here. Open-source frameworks are maintained by volunteers or by companies with their own priorities. If a key framework like OWASP Threat Dragon stops getting updates, teams that depend on it are stuck. Luna: It's happened. Remember when the OWASP AppSensor project went dormant for almost two years? Teams that had built their detection pipelines around it had to scramble. Lucas: Exactly. So the smart approach is to treat open-source threat modeling tools as a layer, not the whole stack. Use them for the modeling workbench, but keep your methodology and documentation in a format you own — like a Git repo with Markdown files. Luna: And there's the question of compliance. Some regulated industries — finance, healthcare — have auditors who expect a specific tool or vendor. If you show up with an OWASP Threat Dragon export, will the auditor accept it? Lucas: That's getting easier. The 2025 survey I mentioned also found that 61 percent of financial services firms now accept open-source threat modeling artifacts for compliance, up from 34 percent in 2022. JPMorgan, for example, has a published policy that accepts any threat model that follows the PASTA methodology — Process for Attack Simulation and Threat Analysis — regardless of the tool. Luna: PASTA is interesting because it's more risk-centric than STRIDE. It has seven stages, from defining objectives to analyzing residual risk. And it was originally developed by a consulting firm, but it's now maintained as an open standard. Lucas: So you have multiple methodologies — STRIDE, PASTA, LINDDUN for privacy, VAST for agile teams — and open-source tools are increasingly letting you mix and match. That's the flexibility I mentioned earlier. You're not locked into one worldview. Luna: What about the actual quality of the threat models produced? Is there a risk that teams using free tools produce lower-quality models? Lucas: I think the risk is more about training than the tool. A bad threat model in Threat Dragon looks the same as a bad threat model in a $50,000 tool. The difference is that with open-source, you can look at how other teams — Netflix, Spotify, Google — structure their models. There's a community aspect that proprietary tools don't have. Luna: Google, for instance, open-sourced its 'SLSA' framework — Supply-chain Levels for Software Artifacts — which is essentially a threat model for the software supply chain. Teams can adopt that framework and map their own pipeline against it. Lucas: And that brings us back to the cost point. Not just the license cost, but the integration cost. Proprietary threat modeling tools often require custom APIs to connect to your CI/CD pipeline, your issue tracker, your vulnerability scanner. Open-source tools that are built on standard formats — like OWASP Threat Dragon's JSON output — can be plugged in with a few lines of code. Luna: So what's the bottom line for a security team considering this shift? Start with a small pilot — one critical service — using OWASP Threat Dragon and the MITRE ATT&CF framework. Map the data flows, identify the threats, and see how the output compares to your current process. Lucas: And don't underestimate the cultural shift. If your developers are used to security handing them a finished threat model, they might resist having to contribute to it. But the teams that succeed are the ones where threat modeling becomes part of the design review, not a separate security gate. Luna: I've seen that work at a mid-size fintech. They used Threat Dragon integrated with GitHub issues. Every time a developer created a new endpoint, a threat model issue was auto-generated. The developer had to triage it before the PR could merge. Lucas: That's a beautiful feedback loop. And it's only possible because the tool was open and extensible. I think we'll see more of that — threat modeling shifting from a periodic exercise to a continuous part of software delivery. Luna: And as open-source frameworks mature, the gap between free and paid will keep narrowing. The question is whether the big vendors — like IriusRisk, Security Compass, and others — will differentiate enough to keep their enterprise customers. Lucas: They'll have to. Because right now, the open-source options are good enough for 80 percent of use cases. And for the teams that need the other 20 percent — advanced analytics, compliance automation, ai assisted threat generation — they'll pay for it. But the baseline is shifting. Luna: Alright, one concrete takeaway: if you're a security architect or a CISO, look at the OWASP Threat Dragon GitHub repo. It's got over 5,000 stars and active contributions. Start there. Lucas: And for the rest of us — developers, product managers, even executives — understanding threat modeling at a high level is becoming a core competency. Because the threats aren't getting simpler, but the tools to model them are finally getting accessible. Luna: That's a good note to end on. Thanks for listening.