Threat modeling
Maps where a system can be attacked, finds the weaknesses behind each entry point and checks which are mitigated and exposed.
When: On a whole repository periodically, and on changes that add an entry point, a trust boundary or a new dependency on external input.
VA09 tactic
5 techniques
13 sub-techniques
not detectable from CI configuration; no usage counts
| ID | Technique | Description | Sub |
|---|---|---|---|
V1059 |
Attack surface inventory | Lists every entry point and trust boundary: API endpoints, webhooks, queues, schedulers, parsers, CLIs, third-party scripts, model calls. | 5 |
V1060 |
Weakness discovery | For each entry point, searches for the weakness classes that apply to it: injection, broken access control, SSRF, deserialization, path traversal. | 2 |
V1061 |
Mitigation mapping | Checks whether each weakness is already mitigated by a control (validation, authorization middleware, rate limits) before reporting it. | 2 |
V1062 |
Exposure verification | Confirms which weaknesses are reachable from outside: external asset discovery and targeted checks against deployed endpoints. | 2 |
V1063 |
Risk prioritization | Orders confirmed weaknesses by exposure, exploit likelihood and impact so fixes start where risk is highest. | 2 |