IT and security / Free editable template

Threat model with STRIDE template

A threat model helps a team find security problems while a system is still being designed. This example draws a web app's data flows across three trust boundaries, numbers each flow, and lists threats by STRIDE category with a mitigation for each, so the design review ends with concrete actions.

Use this template →See the example ↓

No account needed · Opens as your own editable page

Preview the threat model with stride

View full-size preview ↗
Threat model with STRIDE example showing data flow diagram with trust boundaries, numbered flows between components, stride threat and mitigation table
Everything in this example is editable. Replace the labels, move the shapes and adapt the layout to your work.

How to use this template

  1. Draw the data flows

    Sketch the users, processes, data stores and outside services, then number every arrow. Keep it to the level of detail you can review in an hour.

  2. Mark the trust boundaries

    Draw a boundary wherever data crosses from less trusted to more trusted territory. Most threats sit on those crossings.

  3. Walk STRIDE per flow

    For each flow, ask how it could be spoofed, tampered with, denied, leaked, disrupted or used to gain privileges. Record a mitigation and an owner.

Questions about this template

How do the numbered flows link to the table?

Each arrow on the data flow diagram has a number, and the STRIDE table uses the same number for the threats and mitigations on that flow.

Do I need an account to use it?

No. Open the template and edit it in your browser. Your work saves on this device. An account is optional if you want to sync your workspace.

Can I export the finished diagram?

Yes. Use Export in the editor to save a PNG, SVG or PDF, or download an editable .epicdraw backup.

More IT and security templates →