# Threat modeling tooling post

**URL:** <https://threatmodelingconnect.discourse.group/t/threat-modeling-tooling-post/1157>\
**Category:** Techniques & Tooling\
**Created:** [August 25, 2025, 4:57pm UTC](https://threatmodelingconnect.discourse.group/t/threat-modeling-tooling-post/1157 "2025-08-25T16:57:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![adamshostack](https://avatars.discourse-cdn.com/v4/letter/a/e95f7d/32.png) [@adamshostack](https://threatmodelingconnect.discourse.group/u/adamshostack)\
**Post date:** [August 25, 2025, 4:57pm UTC](https://threatmodelingconnect.discourse.group/t/threat-modeling-tooling-post/1157/1 "2025-08-25T16:57:45Z")

</div>

Some thoughts on threat modeling tooling:

> **[Shostack + Friends Blog \> Threat Modeling Tools](https://shostack.org/blog/threat-modeling-tools/?utm_source=mastodon&utm_medium=social&utm_campaign=general&utm_content=post-aug25)**
>
> A 2025 view of threat modeling tools

---

<div class="post-metadata">

**Author:** ![hewerlin](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/hewerlin/32/67_2.png) [@hewerlin](https://threatmodelingconnect.discourse.group/u/hewerlin)\
**Post date:** [August 25, 2025, 8:20pm UTC](https://threatmodelingconnect.discourse.group/t/threat-modeling-tooling-post/1157/2 "2025-08-25T20:20:56Z")

</div>

Liked the post.

I wonder: In your mental model, do you distinguish between methods and tools?

---

<div class="post-metadata">

**Author:** ![adamshostack](https://avatars.discourse-cdn.com/v4/letter/a/e95f7d/32.png) [@adamshostack](https://threatmodelingconnect.discourse.group/u/adamshostack)\
**Post date:** [August 26, 2025, 3:09pm UTC](https://threatmodelingconnect.discourse.group/t/threat-modeling-tooling-post/1157/3 "2025-08-26T15:09:23Z")

</div>

A method is a set of steps, each of which is one or more tasks, which is a thing that can be accomplished in one session with defined inputs and outputs.

---

<div class="post-metadata">

**Author:** ![Dave](https://sea2.discourse-cdn.com/flex002/user_avatar/threatmodelingconnect.discourse.group/dave/32/138_2.png) [@Dave](https://threatmodelingconnect.discourse.group/u/Dave)\
**Post date:** [August 27, 2025, 9:33am UTC](https://threatmodelingconnect.discourse.group/t/threat-modeling-tooling-post/1157/4 "2025-08-27T09:33:47Z")

</div>

I know the post is mostly about LLMs and tooling, but I think an interesting area that I would like to hear stories from others about is that transition between general purpose, small team and enterprise tooling (without implying the transition is always in that order). I’m curious what the driving factors for change were, and whether the effort to change was worth it.

For security tooling in general I think it is interesting to understand when teams decide they want to transition to enterprise tooling. It’s especially interesting for threat modeling tools as they have different scaling challenges (compared to say SAST tools).