# Meet ThreatPad!
**URL:** https://threatmodelingconnect.discourse.group/t/meet-threatpad/741
**Category:** Techniques & Tooling
**Created:** [December 31, 2024, 7:41pm UTC](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741 "2024-12-31T19:41:12Z")
**Posts on this page:** 8
**Page:** 2
### Author:  [@hewerlin](https://threatmodelingconnect.discourse.group/u/hewerlin)
#### Post date: [April 20, 2025, 6:55pm UTC](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741/21 "2025-04-20T18:55:20Z")
Feels like we are starting an awesome discussion.
Letβs move this to itβs own topic.
[π Most awesome risk assessment style? - General - Threat Modeling Connect Forum](https://threatmodelingconnect.discourse.group/t/most-awesome-risk-assessment-style/889/1)
And have this thread\* stay with ThreatPad.
\*) Always strange to write the -d βthreadβ. π€£
---
### Author:  [@hewerlin](https://threatmodelingconnect.discourse.group/u/hewerlin)
#### Post date: [May 2, 2025, 8:06am UTC](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741/22 "2025-05-02T08:06:55Z")
# Want to see ThreatPad in action??
β Read how TMC DACH German chapter used it to threat model online dating like Tinder. πΊπΈ π¬π§ English and π©πͺ German texts available.
[Online Dating Security + π©πͺ TMC DACH Threat Modeling Feierabend - Events - Threat Modeling Connect Forum](https://threatmodelingconnect.discourse.group/t/online-dating-security-tmc-dach-threat-modeling-feierabend/932)
# Highlights / TL;DR
Inspired by [this post by @AppSecSeanner](https://threatmodelingconnect.discourse.group/t/what-s-an-alternative-to-threat-modeling-if-there-was-no-tm-what-the-world-would-have-been/174/3), a ThreatPad βday at the beachβ exercise conveys core threat modeling concepts (and ThreatPad) in 3-5 minutes.
We can see how ThreatPad is super slim and leaves enough space to have system model and methods next to threats and mitigations in a screen share.
---
### Author:  [@hewerlin](https://threatmodelingconnect.discourse.group/u/hewerlin)
#### Post date: [June 11, 2025, 7:18am UTC](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741/23 "2025-06-11T07:18:12Z")
# History?
Iβve experimented with showing the history / pattern how the threat model evolved:
It is cool. And it is creepy. β β I wonβt merge.
If you have any comments, let me know.
# Demo: how I threat modeled Online Dating for meetup preparation
Legend: β created new threat, β created new mitigation, βͺ moved to another threat, βtime passed (5min+)
β β β β β β β β β β β β β β β β β β β β β β β β 23m β β β β 20m βͺ β βͺ β β β β βͺ β β β β βͺ β β 7m β β β 5m β β 9m β β 10d β β β β 3d β β 8d β β β β 18h β β β 37d β β β β 17h β β 5d β β β β β β β β β βͺ β βͺ β β β βͺ β βͺ β β β βͺ β β β β β β β βͺ β β β βͺ β β β β β βͺ β β βͺ β βͺ β βͺ β βͺ β β βͺ β βͺ β β β β βͺ β β βͺ β βͺ β β βͺ β β β β βͺ β βͺ β β β β 1d β β 5d βͺ β β β βͺ β βͺ β βͺ β β βͺ β β β β β 10m β β 6m β β 22d β β 19h β β 4d βͺ β βͺ β βͺ β βͺ β βͺ β β βͺ β βͺ β β β βͺ β β βͺ β β βͺ β β β β β 2d βͺ β βͺ β β β βͺ β β β 36m βͺ β βͺ β βͺ β β β β β βͺ β βͺ β β β βͺ β βͺ β βͺ β β 7m βͺ β β β β 8m β βͺ β
---
### Author:  [@hewerlin](https://threatmodelingconnect.discourse.group/u/hewerlin)
#### Post date: [October 14, 2025, 7:33pm UTC](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741/24 "2025-10-14T19:33:58Z")
# Should I add Effective / Expensive feature?
Iβm experimenting with effective / expensive widgets when editing mitigations:
Effective has ? π€·πΌββοΈ / low π‘ / medium π‘π‘ / high π‘π‘π‘. (Whatβs better emojis? I started with πͺ but it requires skin colorsβ¦)
Expensive has ? π€·πΌββοΈ / low π° / medium π°π° / high π°π°π°. (Also not the perfect emoji, because not all expense is moneyβ¦)
Pro: Educates that feasibility and costs matter.
Pro: Educates that not all protection is 100%.
Pro: Educates that some mitigations have good ROI.
Contra: With the words of Github, βAnything added dilutes everything else.β
β **Should I merge the feature?**
## Context
- Threatpad already has a style for threats and mitigation which can be β
done / β favorite / normal style / π rejected. This educates about [propose-then-choose flow](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741/6) and that only done mitigation really counts. Itβs only visible when editing.
- Threatpad already has βHow likely?β / βHow bad?β which can be ? π€·πΌββοΈ / low π΄ / medium ππ / high π±π±π±. This educates about qualitative risk assessment. It is already shown in the threat view.
- All the select features are designed so that they donβt annoy you when you donβt use them.
---
### Author:  [@hewerlin](https://threatmodelingconnect.discourse.group/u/hewerlin)
#### Post date: [November 19, 2025, 8:07pm UTC](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741/25 "2025-11-19T20:07:28Z")
# Facilitators view
Wanted to share real quick how [Global Threat Model Together Day 2025: What we modeled, what we learned - Events & Highlights - Threat Modeling Connect Forum](https://threatmodelingconnect.discourse.group/t/global-threat-model-together-day-2025-what-we-modeled-what-we-learned/1195) shows how facilitators used ThreatPad for multiple sessions:
ThreatPad is slim because of itβs mobile-first design.
Also, it can be embedded in an iframe.
We made a facilitators birdβs eye view that observed the sessions as new threats and mitigations kept coming in. π
The feature is not official. Itβs just what everyone can do by creating multiple spaces and embedding.
If you want to do the same, you may want to add the URL parameters `?bottom&refresh=10`. `bottom`scrolls to the bottom in the overview when new things arrive. `refresh=10`refreshes every 10 seconds. With the normal long-polling style, most browsers only handle 7 parallel requests.
# Yet another success
The whole [Global Threat Model Together Day 2025: What we modeled, what we learned - Events & Highlights - Threat Modeling Connect Forum](https://threatmodelingconnect.discourse.group/t/global-threat-model-together-day-2025-what-we-modeled-what-we-learned/1195) was a huge success with ThreatPad being a part of it.
Hereβs the setup and screen that facilitators shared. It has ThreatPad on the left, where threats and mitigations were gathered. It has enough space for system diagram, method cheat sheet and instructions on the right.
This is similar to what we did in [Online Dating Security + π©πͺ TMC DACH Threat Modeling Feierabend - Events & Highlights - Threat Modeling Connect Forum](https://threatmodelingconnect.discourse.group/t/online-dating-security-tmc-dach-threat-modeling-feierabend/932):
---
### Author:  [@PaulSpruce](https://threatmodelingconnect.discourse.group/u/PaulSpruce)
#### Post date: [November 21, 2025, 6:53pm UTC](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741/26 "2025-11-21T18:53:51Z")
I like that, what determines the level of expense? So what is the threshold for low,med,high etc π
---
### Author:  [@hewerlin](https://threatmodelingconnect.discourse.group/u/hewerlin)
#### Post date: [January 26, 2026, 12:29pm UTC](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741/27 "2026-01-26T12:29:31Z")
Same like with the Likelihood/Impact feature: Itβs intentionally vague. π
For now, I have paused the effective / expensive thing and wonβt ship itβ¦
---
### Author:  [@hewerlin](https://threatmodelingconnect.discourse.group/u/hewerlin)
#### Post date: [January 26, 2026, 12:33pm UTC](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741/28 "2026-01-26T12:33:28Z")
Iβm currently working on a username feature.
The idea is that individual contributors or teams can leave their name, so that their contributions in a shared ThreatPad are attributed.
Even in a big workshop, the hope is that I can let everyone share a single (!) ThreatPad and interact with each othersβ threats and mitigations.
Let me know if you have any thoughts on that one.
[Previous page](https://threatmodelingconnect.discourse.group/t/meet-threatpad/741.md?page=1)