Stage 1 · Lesson 1 of 7
Threat modelling in four questions
is a structured way to find what could go wrong in a system before an attacker does. The Threat Modeling Manifesto boils it down to four questions. What are we working on?
What can go wrong? What are we going to do about it? Did we do a good job?
You answer the first with a simple diagram of users, components, data stores and the arrows between them. For the second, prompts such as (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) help you think widely.
Each threat then gets a fix and an owner. Every later stage of this roadmap adds AI-specific boxes to the same diagram.
Common traptreating threat modelling as a long document written once, when a one-page diagram you update with every new feature is far more useful.
A question to check yourself, an AI practice session and 1 cheat sheet entry come with the full roadmap. Unlock
Resources for this stage
Start with· follow one of these
- RoadmapFreeSefism Cybersecurity Roadmap
Sefism · Beginner
Sefism's general security roadmap, for any foundation in this stage you want to study in more depth
- CourseFreeProfessor Messer's Security+ (SY0-701) Course
Professor Messer · Beginner
Free videos covering the core security concepts, from access control to cryptography
Practise
Keep handy
Also worth your time
The four questions, diagrams and STRIDE in one practical page
- roadmap.sh: Cyber SecurityGo deeper
A map of the wider security field, so you know where AI testing sits