Technique · Threat modeling

Attack surface inventory

Lists every entry point and trust boundary: API endpoints, webhooks, queues, schedulers, parsers, CLIs, third-party scripts, model calls.

Sub-techniques

Network entry points V1059.001

HTTP, gRPC, WebSocket, raw socket and webhook receivers.
Asynchronous entry points V1059.002

Queue consumers and scheduled jobs that act on external data.
Data parsers and deserialization V1059.003

File, archive and object parsers that take untrusted input.
Infrastructure and configuration V1059.004

Infrastructure as code, secrets management, caching and edge routing.
AI and model interactions V1059.005

Prompts, tools and retrieved content that cross a trust boundary.