Skip to content

STRIDE Model

Enumerate software threats across Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege against a concrete system model.

Version
v2 · 2026-09-06 · History
Domain-specific #
2872
Origin domain
computer science
Subdomain
software security
Aliases
STRIDE threat model, STRIDE threat taxonomy, STRIDE methodology

Core Idea

STRIDE is a threat-enumeration model for systematically asking how a designed system could fail under six adversarial categories: Spoofing identity, Tampering with data or code, Repudiation of actions, Information disclosure, Denial of service, and Elevation of privilege. Analysts apply the categories to processes, data stores, flows, external entities, and especially trust-boundary crossings in a concrete architecture.[1]

The recognition invariant is system model + six threat categories + element-by-element enumeration + plausible threat scenarios + mapped mitigations. STRIDE is a completeness aid for discovery, not a probability, severity, or compliance score.

Structural Signature

  • Defined security scope, assets, and assumptions.
  • Architecture or data-flow diagram.
  • Processes, stores, flows, actors, and trust boundaries.
  • Six STRIDE categories applied systematically.
  • Spoofing linked to identity/authentication failure.
  • Tampering linked to integrity violation.
  • Repudiation linked to missing accountability/nonrepudiation evidence.
  • Information disclosure linked to confidentiality loss.
  • Denial of service linked to availability degradation.
  • Elevation of privilege linked to authorization boundary breach.
  • Concrete scenario including actor, target, precondition, and consequence.
  • Mitigation/control and residual-risk follow-up.
  • Versioned assumptions and model updates as design changes.

What It Is Not

It is not DREAD or another risk-scoring scheme. It does not assign likelihood, impact, priority, or acceptance. It is not an attack tree, although its findings can populate one. It is not a vulnerability scanner and does not prove the absence of uncategorized threats.[2]

It is also not “apply each letter once.” One element can have many scenarios in one category, and some category–element pairings may be irrelevant only after reasoned review.

Scope of Application

STRIDE supports software architecture reviews, cloud services, Windows drivers, APIs, distributed systems, identity flows, data pipelines, and security design training. Microsoft incorporates it into threat-modeling guidance and maps categories to counter-properties such as authentication, integrity, confidentiality, availability, authorization, and nonrepudiation.[3]

Physical safety, fraud incentives, privacy harms, supply-chain compromise, and abuse cases may require additional lenses even when individual events can be forced into STRIDE.

Clarity

A category is not a scenario. “Tampering” becomes actionable only when the analyst states which data can be changed, where, by whom, through what boundary, and with what consequence.

Repudiation concerns inability to establish responsibility, not merely a user denying something. Elevation of privilege is unauthorized acquisition/use of capabilities, distinct from spoofing another identity even when one attack chain includes both.

Manages Complexity

The mnemonic turns an open-ended adversarial brainstorm into a bounded matrix over system elements. It reduces omission risk and gives teams shared vocabulary.

The reduction can create checkbox behavior. Quality still depends on the fidelity of the system model, creativity of scenarios, knowledge of attackers, and follow-through on mitigation.

Abstract Reasoning

  1. Bound the system and assets.
  2. Draw data flows and trust boundaries.
  3. Enumerate elements and entry points.
  4. Apply each STRIDE category to each relevant element.
  5. Convert category prompts into concrete scenarios.
  6. Record assumptions, prerequisites, consequences, and existing controls.
  7. Map mitigations and separately assess risk/priority.
  8. Validate coverage with abuse cases and other security lenses.
  9. Revisit the model after architectural change.

Knowledge Transfer

The portable structure is exhaustive classification across a modeled surface. The proposed immediate parent is Classification.

Examples

API boundary. A forged token is spoofing; altered request data is tampering; exposure of another tenant’s response is information disclosure; exploiting an admin-only endpoint is elevation of privilege.

Audit log. If an actor can perform a sensitive action without durable attributable evidence, the scenario is repudiation.

Non-example. Calling a component “high risk” without a scenario or category is risk labeling, not a STRIDE analysis.

Structural Tensions

  • Enumeration completeness versus false assurance.
  • Category simplicity versus chained attacks.
  • Design model versus deployed reality.
  • Threat discovery versus risk prioritization.
  • Shared vocabulary versus category overlap.
  • Broad applicability versus missing abuse/privacy/safety lenses.

Structural–Framed Character

Classification, matrix coverage, scenario construction, and boundary traversal are structural. Software elements, security properties, attacker capabilities, controls, and Microsoft methodology are domain frame.

Structural Core vs. Domain Accent

The portable core is applying a fixed taxonomy across every modeled element. STRIDE letters, data-flow diagrams, trust boundaries, authentication, integrity, confidentiality, availability, and authorization are constitutive domain accent.

Classification is the proposed immediate parent. Attack Surface, Boundary, Adversarial Thinking, Defense in Depth, and Risk Assessment are related.

The prospective queue contains one strict edge to prime:classification. No live DAG mutation is authorized.

Relationships to Other Abstractions

Local relationship map for STRIDE ModelParents appear above the current abstraction, mutual partners to the right, and children below. Node labels state whether each abstraction is prime or domain-specific; colors identify relation types.STRIDE ModelDOMAINPrime abstraction: Classification — is a kind ofClassificationPRIME

Current abstraction STRIDE Model Domain-specific

Parents (1) — more general patterns this builds on

  • STRIDE Model is a kind of Classification Prime

    Classification is the proposed immediate parent.

Hierarchy path (1) — routes to 1 parentless root

Neighborhood in Abstraction Space

STRIDE Model sits in a sparse region of the domain-specific corpus (95th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Unclustered & Miscellaneous (1565 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-09-08

Not to Be Confused With

  • Risk scoring or DREAD.
  • Vulnerability scanning.
  • Attack trees.
  • Security requirements themselves.
  • Proof of complete threat coverage.
  • A list of six words without system-specific scenarios.

References

[1] Microsoft, “Microsoft Threat Modeling Tool Threats”, official documentation. registry ↩

[2] Adam Shostack, Threat Modeling: Designing for Security, Wiley, 2014. registry ↩

[3] Michael Howard and David LeBlanc, Writing Secure Code, 2nd ed., Microsoft Press, 2003. registry ↩

[4] Frank Swiderski and Window Snyder, Threat Modeling, Microsoft Press, 2004. registry ↩