How do you run a threat model that results in code changes rather than a report?

What is being tested

Whether you can make a security exercise produce work, which is the difference between threat modelling and threat documenting.

The method that produces useful findings

Walk the data flow diagram, boundary by boundary. For each trust boundary crossing, apply the standard categories: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege.

This beats free-form brainstorming because it is systematic, bounded, repeatable, and it produces threats attached to a specific place in the system rather than to the system in general — which is what makes them fixable.

Two hours with the right people covers most systems.

Who is in the room

Engineers who know the system, someone with security expertise, and someone who understands business impact.

Security alone produces findings nobody owns. Engineers alone miss attacker perspectives. Both together produce findings the team accepts, which is the point.

What makes the output actionable

1. Prioritise by risk, not by cleverness. An unlikely sophisticated attack with low impact ranks below a mundane misconfiguration with high impact — and the mundane one is what actually happens.

2. One line per threat with an owner and a decision: mitigate, accept, transfer, avoid. Explicit acceptance is a legitimate outcome and is far better than an unaddressed finding sitting in a document.

3. State the assumption behind each acceptance, so it can be revisited when the assumption changes.

4. Findings become backlog items with the same visibility as features. This is the step that decides everything — a threat model whose output is a document changes nothing, and everyone involved knows it.

5. Repeat when the architecture changes. A model done once at design time describes a system that no longer exists.

Communicating upward

Executives need risk in business terms — what could happen, how likely, what it would cost, what prevention costs. Not a list of vulnerability categories.

The most effective framing is comparative: "these three risks are outside our stated appetite; the remainder are within it." That invites a decision rather than an acknowledgement.