Awesome Reviewers checks + prompts

Risk prioritization

Orders confirmed weaknesses by exposure, exploit likelihood and impact so fixes start where risk is highest.

V1063 technique
tactic Threat modeling
not detectable from CI configuration

Sub-techniques

2

IDNameDescription
V1063.001Decision treesSSVC decisions from exploitation, exposure and impact.
V1063.002Likelihood scoresEPSS for known vulnerabilities.

Craft it

  1. Score exposure from the attack surface inventory.
  2. Combine with likelihood and impact through a fixed decision tree.
  3. Recompute when exposure changes.

Reverse engineer it

Signs that a codebase already runs this technique, and where to read how it is configured.

  • Vulnerability management dashboards or SECURITY.md response targets.

Open-source packages

2

Other techniques in Threat modeling