Threat Modeler Tool Complete Guide

The unified canvas tool helps you map your architecture and run STRIDE analysis in one workspace. The tool is a full-screen app: you open it from Tools › Modeling › Threat Modeler Tool, and this guide opens from the Help button in its top bar.

Document the model itself before or alongside the architecture. The name lives in the top bar; the rest sits in the Inspector's Model Metadata section and appears in reports and the readiness gate.

Assumptions & Constraints have their own register in the Inspector, and the report's Assumptions Register lists them with their status. Review metadata travels inside the model JSON, so a save/import round-trip preserves the author, version, status and approver.

Components are the building blocks of your system. Add all significant parts that process, store, or transmit data. The palette groups them into External, Infrastructure, Security Controls, Data & Storage and Utilities; the Core / Presets / All views and the search box narrow the list.

Representative Component Types

Trust Zones

Assign each component a trust level in the Inspector to define security boundaries:

Need a level the four defaults do not cover? In the Inspector choose Trust Level › Add custom level…, give it a label and a colour, and it is applied straight away. The colour paints the Perimeter rail, the zone chip and the canvas band, while the stored model keeps the level's id.

Data flows show how information moves between components. Draw them on the canvas, then refine each one with the flow quick editor or the Inspector.

STRIDE is Microsoft's threat classification framework. For each component and data flow, consider these threat categories:

The Threats Tab

The Threats tab is the threat inventory. A search box sits next to a Filters disclosure (which shows the number of active filters) and a compact view switcher with four modes:

The Scoring tab supports three scoring models. Pick one with the DREAD / CVSS / CUSTOM control at the top; threats sort by that model's score, and unscored threats are listed first so nothing is forgotten.

DREAD Scoring

DREAD helps prioritize threats by scoring them on five factors. Each factor is rated 0–10, and the average gives the overall risk score.

The score is the average of the five factors, resolved to a risk band:

CVSS 3.1 Base Score

The Common Vulnerability Scoring System (CVSS) provides a standardized method for rating security vulnerabilities. The tool calculates the CVSS 3.1 base score from eight base metrics and produces the matching vector string. Only the base calculation is wired in the modeler.

Custom Scoring

The Custom model is a lightweight likelihood × impact score: rate each on 1–5 and the tool derives a score and severity. It is useful when neither DREAD nor CVSS matches how your team already talks about risk.

For each threat, document the security controls that reduce or eliminate the risk. Mitigations are tracked separately from threat status, and each mitigation can map to the control frameworks used by the compliance views.

Attack paths chain multiple threats together to show realistic attack scenarios. Build and review them in the Threats › Paths view — there is no separate Attacks tab. Paths rank high-risk first, then by length and by their impact × likelihood score, so the heaviest chain leads.

The paths view shows the total path count, how many are high risk and the longest chain. The same paths appear in the Threat Story's Paths section, each with its mitigated and unmitigated steps.

The Perimeter rail is a persistent list of the model's trust zones. Zones are derived from the model, not fixed: each drawn trust boundary becomes a zone, and components that sit inside no boundary contribute a zone for their declared trust level, so even a boundary-less model still has a perimeter.

The Report tab has two views: Report for export-oriented reporting, and Story for the narrative walkthrough (covered in the next section). On mobile, Story is the default.

Report Profile

Every export uses a shared profile: a persona preset, a theme, a quality setting, a primary diagram variant, and toggles for annotations, mitigations, attack-path diagrams and the diagram appendix. Persona presets are Executive (concise diagram pack and top risks), Engineering (full diagrams, heatmap and attack paths) and Audit (delta-aware and compliance-friendly).

Formats

Report sections

Below the export controls the Report view includes a snapshot diff (added, removed and changed threats), a compliance view and gap matrix against NIST 800-53, ISO 27001 A, SOC 2 TSC and CIS Controls, a "What Did I Miss?" STRIDE coverage heatmap, the CI policy gate, the assumptions register, automated checks, boundary-crossing analysis, orphan detection, an editable executive summary, a STRIDE coverage matrix and the recent activity log.

The Story view in the Report tab is a graph-free, zone-ordered narrative of the model, written for someone who will not open the canvas. It is the default view on mobile and prints through its own Print / Save PDF button.

The readiness chip in the status bar opens the Model readiness dialog. It answers one question: is this model defensible enough to sign off?

These are the bindings the tool implements. On macOS, use ⌘ in place of Ctrl.