Threat model
A structured account of assets, actors, entry points, trust boundaries, and plausible attacks.
What Threat model means
It guides controls but becomes stale as architecture and capabilities change.
Where Threat model comes up on this site
- Why a self-identifying crawler header must never clear a checkThe threat model is one line long.
Related terms in Security and privacy
Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.
lookalike domain · homoglyph · incident switch · high-risk field · Indirect prompt injection · Direct prompt injection · Jailbreak · Data exfiltration · Sensitive information disclosure · Secret leakage · Insecure output handling · Excessive agency · Least privilege · Trust boundary · Input validation · Output validation · Allowlist · Denylist · SSRF · RCE · Credential scope · OAuth scope · API key · Bearer token · mTLS · Rate-limit policy · Audit log · PII · Data minimization · Purpose limitation · Retention period · Data residency · Tenant isolation · DMARC · DMARC alignment · SPF · DKIM · MTA-STS · TLS-RPT · CAA record · DNSSEC · hard bounce
Questions about Threat model
What is Threat model?
A structured account of assets, actors, entry points, trust boundaries, and plausible attacks.
Which area of the glossary does Threat model belong to?
Security and privacy: Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.
← Tenant isolation · DMARC →
See it in the full glossary · 731 terms across 19 areas.