Make it a team activity, not a job for one security hero

The Manifesto lists the Hero Threat Modeler as an anti-pattern: threat modeling does not depend on innate ability or a unique mindset, and everyone can and should do it. Its values favor people and collaboration over processes, methodologies and tools.

Who to invite, following the Manifesto's Varied Viewpoints pattern:

• the engineers building the feature, who know how it really works
• someone who operates it in production, who knows the deploy and access paths
• a product owner, who knows what the feature is for and what misuse would hurt
• a security person when available, as a coach rather than the sole author

The OWASP cheat sheet names the usual blockers: limited security knowledge, time pressure, and poor communication between teams. Its suggested fixes are practical: involve security specialists in sessions, give regular training, use tools that simplify the work, and run cross-team workshops.

A rotating facilitator helps. The facilitator keeps the session on the four questions and makes sure decisions are written down, while the people who own the code do the thinking.