# Recap: Developing a Threat Modeling Mindset (Threat Modeling Fundamentals Workshop) **URL:** \ **Category:** Events & Highlights\ **Tags:** recap\ **Created:** [April 2, 2025, 12:38am UTC](https://threatmodelingconnect.discourse.group/t/recap-developing-a-threat-modeling-mindset-threat-modeling-fundamentals-workshop/861 "2025-04-02T00:38:17Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![shuning](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/shuning/32/6_2.png) [@shuning](https://threatmodelingconnect.discourse.group/u/shuning)\ **Post date:** [April 2, 2025, 12:38am UTC](https://threatmodelingconnect.discourse.group/t/recap-developing-a-threat-modeling-mindset-threat-modeling-fundamentals-workshop/861/1 "2025-04-02T00:38:17Z")
On 2025-04-01T07:00:00Z, we hosted the Threat Modeling Fundamentals Workshop - Developing a Threat Modeling Mindset with Robert Hurlbut. Based on his well-received in-person workshop on a similar topic at many major security conferences (including twice at our very own #threatmodcon!), Robert adapted this session into a virtual experience for TMC members and our 2025 #hackathon participants. ### Key takeaways A Threat modeling mindset is to: - Be strategic - Be curious / asking questions - Be prepared - Be active The four principles align well with the four steps of a typical threat modeling process: | Mindset | Threat Modeling Step | | --- | --- | | Be strategic: ‘Thinking ahead’ | Understand your system & data flows | | Be curious: ‘What if? What could go wrong?’ | Identify threats | | Be prepared - ‘Focused defense’ | Document threats | | Be active - ‘Review, follow through’ | Actively review, follow through, repeat | To put this into practice, we ran two hands-on exercises based on [an example web application](https://4550632.fs1.hubspotusercontent-na1.net/hubfs/4550632/Threat%20Modeling%20Connect/Threat%20Modeling%20Lab/Developing%20a%20threat%20modeling%20mindset/Threat%20Modeling%20Hackathon%202025%20-%20ACME%20Web%20Application%20DFD.png): - Threat Hunt – focused on being curious and identifying potential threats - Mitigation Brainstorming – focused on being prepared and developing proactive defense strategies Check out the output from our exercises below! 👇 ([PDF](https://4550632.fs1.hubspotusercontent-na1.net/hubfs/4550632/Threat%20Modeling%20Connect/Threat%20Modeling%20Lab/Developing%20a%20threat%20modeling%20mindset/Workshop%20Developing%20a%20Threat%20Modeling%20Mindset_2025-04-01_22-27-55.pdf)) ![Workshop Developing a Threat Modeling Mindset_Whiteboard](https://us1.discourse-cdn.com/flex002/uploads/threatmodelingconnect1/original/1X/77feddca93e64e7b56f15baae23b1cf9aed13e76.jpeg) ### Slides [Access Robert’s slides →](https://4550632.fs1.hubspotusercontent-na1.net/hubfs/4550632/Threat%20Modeling%20Connect/Threat%20Modeling%20Lab/Threat%20Modeling%20Hackathon%202025%20-%20Developing-Threat-Modeling-Mindset-Workshop%20-%20RobertHurlbut.pdf) ### Resources Here are some additional Robert recommended: - Threat modeling manifesto: [https://www.threatmodelingmanifesto.org/](https://www.threatmodelingmanifesto.org/) - Threat modeling capabilities: [Threat Modeling Capabilities](https://www.threatmodelingmanifesto.org/capabilities/) - Books (View the full list in his slides) - Hacking Kubernetes: Threat-Driven Analysis and Defense (2021) Andrew Martin, Michael Hausenblas - Threat Modeling: A Practical Guide for Development Teams (2020) Izar Tarandach and Matthew Coles - Playbook for threat modeling medical devices (2021) MITRE: [https://www.mitre.org/sites/default/files/2021-11/Playbook-for-Threat-Modeling-Medical-Devices.pdf](https://www.mitre.org/sites/default/files/2021-11/Playbook-for-Threat-Modeling-Medical-Devices.pdf) ### Replay Watch the full session [![](https://us1.discourse-cdn.com/flex002/uploads/threatmodelingconnect1/original/1X/b64c1ee4a9390aecb360b1a89d358c99cc882ecf.jpeg "Developing a 'threat modeling mindset' following four steps of the threat modeling process") ](https://www.youtube.com/watch?v=1e4AUaNV9Yw) ### Shoutouts A big thank you to everyone who joined us, and a special shoutout to our breakout room facilitators: Adrian Bettag, Ari Kalfus, Donavan Cheah (@donavancheah), John Taylor (@JohnT), Natalia Semenova, Pankaj Joshi, Pankaj Upadhyay, Praveen Gupta – you made the hands-on exercises such a success. And of course, massive thanks to Robert Hurlbut (@roberthurlbut) for bringing this valuable session to our community! 💎 ![](https://us1.discourse-cdn.com/flex002/uploads/threatmodelingconnect1/original/1X/ef747b2e3fa355a76f34245d1c1840e1edf87c47.png) ![](https://us1.discourse-cdn.com/flex002/uploads/threatmodelingconnect1/original/1X/1bb0619d33fbbf5c9504de452d24c182b24893e6.png) ---
**Author:** ![hewerlin](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/hewerlin/32/67_2.png) [@hewerlin](https://threatmodelingconnect.discourse.group/u/hewerlin)\ **Post date:** [April 2, 2025, 12:22pm UTC](https://threatmodelingconnect.discourse.group/t/recap-developing-a-threat-modeling-mindset-threat-modeling-fundamentals-workshop/861/2 "2025-04-02T12:22:18Z")
Sounds great! Enjoy the hackathon, players! 😎 🤖 🚘 🥳 ---
**Author:** ![Prabhav\_impact](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/prabhav_impact/32/278_2.png) [@Prabhav\_impact](https://threatmodelingconnect.discourse.group/u/Prabhav_impact)\ **Post date:** [April 2, 2025, 4:03pm UTC](https://threatmodelingconnect.discourse.group/t/recap-developing-a-threat-modeling-mindset-threat-modeling-fundamentals-workshop/861/3 "2025-04-02T16:03:57Z")
An amazing and to-the-point practical workshop that jumped into actually getting hands dirty and think like a TM professional. Looking forward for more such workshops.