What is Threat Modeling as Code?
Threat Modeling as Code is the practice of implementing threat modeling via defining the system architecture, data flows, and security threats using machine readable files stored in version control. It mostly use yaml, python, etc. In fact, using code for threat modeling has significant advantages.
Popular Threat Modeling as Code Tools:
There are lots of open source or free tools available to practice this trend.
Plant UML:
PlantUML is an option for organizations embracing full code-based threat modeling practices, since diagrams and flows can be managed in code repositories. Individual use of plantuml will be a bit complex as it the information of threats within the diagram itself.
Below is the sample puml code for quick demonstration.
@startuml Simple_STRIDE_Demo
title Simple Web App - STRIDE Threat Model
skinparam rectangle {
BorderColor #34495E
FontSize 13
}
skinparam ArrowColor #34495E
skinparam defaultTextAlignment center
actor "User" as user
rectangle "Web App\n(Frontend)" as webapp #E8F0FE
rectangle "API Server\n(Backend)" as api #FFF9E6
database "Database" as db #E9F7EF
rectangle "Auth Service" as auth #F4E9F7
user --> webapp : 1. Login / browse
webapp --> api : 2. API calls (HTTPS)
api --> auth : 3. Validate token
api --> db : 4. Query / update data
note right of user #FADBD8
**Spoofing**
Attacker impersonates a
legitimate user (stolen credentials,
session hijacking)
end note
note right of webapp #FCF3CF
**Tampering**
Client-side data or requests
modified before reaching the API
(e.g. tampered form fields)
end note
note right of api #E8DAEF
**Elevation of Privilege**
Broken access control lets a
normal user reach admin endpoints
end note
note right of auth #FADBD8
**Spoofing**
Weak token validation allows
forged or replayed tokens
end note
note bottom of db #D5F5E3
**Information Disclosure**
Sensitive data exposed via
unencrypted storage or verbose
error messages
end note
note left of api #AED6F1
**Denial of Service**
No rate limiting — API can be
flooded with requests
end note
note bottom of webapp #FDEBD0
**Repudiation**
No logging of user actions —
user can deny performing an action
end note
legend right
|= Color |= STRIDE Category |
|<#FADBD8> | Spoofing |
|<#FCF3CF> | Tampering |
|<#FDEBD0> | Repudiation |
|<#D5F5E3> | Information Disclosure |
|<#AED6F1> | Denial of Service |
|<#E8DAEF> | Elevation of Privilege |
endlegend
@enduml
Visit https://plantuml.com and try the above code for quick result.
Another way is running locally or this can be integrate into any tool/automation to generate the data flow diagram or sequential diagram, all as part of a threat modeling as code workflow.
Download the plantuml jar file, which can be use on cross platform –https://github.com/plantuml/plantuml/releases#release-v1.2026.8
Run it with the example plantuml code which given above or use web-infra.puml with C4-PlantUML library
Git clone the C4 PlantUML repository
https://github.com/plantuml-stdlib/C4-PlantUML.git
Place the web-infra.puml, plantuml jar file into the C4 directory and execute the command below.
java -jar plantuml-1.2026.7.jar web-infra.puml
It will provide the output given below.
Pytm:
Pytm is a Python library that provides a programmatic way of threat modeling; the application model itself is defined as a python3 source file and follows Python program syntax. Findings are included in a template-defined threat modeling report. The threat file can be reused between projects and provides for accumulation of a knowledge base.
There are some below prerequisites for pytm, make sure to install all of them.
- Python 3.11+ (via apt install python3)
- Graphviz package (via apt install graphviz)
- Java (OpenJDK 10 or 11)
- plantuml.jar
Download the pytm from github
https://github.com/OWASP/pytm.git
Execute the command below to generate the data flow diagram(DFD) of default tm.py example.
./tm.py --dfd | dot -Tpng -o tm/dfd-1.png
Same applies if user wants to generate the sequential diagram, it requires plantuml jar.
./tm.py --seq | java -Djava.awt.headless=true -jar plantuml.jar -tpng -pipe > tm/seq.png
If user want to generate the report, use the command below with the predefine .md templates.
./tm.py --report docs/advanced_template.md | pandoc -f markdown -t html > tm/report.html
TaaC-Ai:
AI-driven Threat Modeling-as-a-Code (TaaC-AI). It leverages AI to analyze service descriptions, identify security threats, visualize data flow and suggest remediations based on the STRIDE framework and OWASP guidelines. The script generates in-depth HTML report and includes feature for manual risk assessment.
Download the Taac-AI and install the requirements through virtual environment using command given below.
git clone https://github.com/pentestguy/TaaC-AI.git
cd TaaC-AI
python3 -m venv .taac-ai
source .taac-ai/bin/activate
pip install -r requirements.txt
Pull the mistral model and run it, either or use claude or openai.
ollama pull mistral
ollama serve
Execute the command below, to generate the report in html format.
python3 TaaC-AI.py --model mistral OrderService-example.yaml --debug
Threagile:
Threagile allows security engineers to perform all required threat modeling steps as code using YAML and keep everything versioned.
Download and use it locally via docker – https://hub.docker.com/r/threagile/threagile
Or for a quick result open https://run.threagile.io/ and upload the yaml file.
It automatically download the results zip file which includes the files shown below.
Conclusion:
These are the some of tools with demo which can be use for threat modeling as code practice. And helps to unlocks new opportunities for collaboration and automation in modern development. Want to collaborate on real-world testing, tool development, or writing? Reach out via the Collaboration page. Thank you!!
