OWASP Rapid Developer-driven Threat Modeling (RaD-TM)

The Rapid Developer-driven Threat Modeling (RaD-TM) methodology empowers developers to perform lightweight, effective threat modeling as part of their regular workflow. Unlike traditional, expert-driven approaches that are heavy, slow, and difficult to scale, RaD-TM provides a simple, repeatable six-step process supported by reusable Threat Templates. It allows developers and teams to identify threats, apply controls, and prioritize risks early in the design phase—minimizing costly rework while improving security outcomes.

Problem Statement

Traditional threat modeling methods require deep security expertise and attempt to model entire systems at once, which is impractical for modern agile development. This creates bottlenecks and delays, often resulting in late-stage security findings when changes are expensive. Developers need a lightweight, accessible methodology that can be applied early and continuously throughout the development lifecycle.

Innovation

As far as we know, there is currently no formal threat modeling methodology specifically aimed at developers. The RaD-TM methodology fills this gap by introducing Threat Templates: concise, context-specific lists of threats and controls—that allow developers to perform effective threat modeling independently. This approach drastically reduces the involvement of the security team, making the activity scalable across large or fast-moving organizations. RaD-TM’s six-step process is simple, fast, and repeatable, seamlessly integrating into modern agile and DevOps workflows while ensuring consistency and quality in security analysis.

Methodology:

Presentations:

Road Map

Phase 1 (0–6 months):

  • Involve additional project members possibly representing organizations with different sizes and regulatory obligations.
  • Publish the RaD-TM methodology as an OWASP guide
  • Release initial Threat Templates and example models (we aim to have a collection of at least 10 Threat Templates aimed at different roles in the SDLC)
  • Set up GitHub repository and community channels

Phase 2 (6–12 months):

  • Expand Threat Template library (e.g., for additional standards/environments reaching at least 20 Threat Templates)
  • Host community sessions or webinars

Phase 3 (12+ months):

  • Develop basic automation tools or integrations
  • Collaborate with other OWASP projects (e.g. Threat Dragon) for support of RaD-TM into threat modeling tools.
Watch Star