baselineRFIWhat threat-modeling methodology does the platform implement (STRIDE, PASTA, attack trees, or a proprietary framework), and can teams choose or customize the methodology per project, or is it a fixed single approach?weight 3
Answer key — what a strong answer shows
Look for explicit methodology naming and configurability; a vendor unable to name a real methodology likely has a shallow, checkbox-style tool.
baselineRFPDescribe how the platform generates or assists in generating the initial threat model from system design — automated diagram-to-threats analysis, architecture-as-code (Terraform/IaC) ingestion, or fully manual diagramming — and quantify the time savings with a customer reference.weight 3
Answer key — what a strong answer shows
Automated or semi-automated generation from existing design artifacts (diagrams, IaC) saves real time over fully manual threat modeling; look for a concrete time-saved figure from a named customer, not a marketing estimate.
baselineRFIHow does the platform keep a threat model current as the system design changes — is there a mechanism to detect when an architecture diagram or IaC definition has drifted from the last-modeled version and flag it for re-review?weight 3
Answer key — what a strong answer shows
Threat models frequently go stale after the initial modeling session; look for a real drift-detection mechanism, not an assumption that teams will remember to manually re-run modeling.
baselineRFIWhat is the output format for identified threats and mitigations — does it integrate directly with ticketing (Jira) for mitigation tracking, or is the threat model a standalone document/diagram disconnected from the engineering workflow?weight 3
Answer key — what a strong answer shows
Direct ticketing integration turning identified threats into tracked, assignable work is stronger than a standalone document that risks being produced once and never acted on.
baselineRFPDetail how the platform scales threat modeling across many teams/services (self-service for developers versus requiring a dedicated security architect per model), and describe the security-review bottleneck reduction achieved with a customer reference.weight 3
Answer key — what a strong answer shows
Self-service capability that doesn't require a security architect in every session is the core scaling value proposition of a threat-modeling platform; ask for a concrete bottleneck-reduction figure from real usage.
baselineRFIDoes the platform maintain a library of common threat patterns and mitigations specific to particular architectures (microservices, serverless, mobile) or technologies (specific cloud services), or does it require the team to build the threat library themselves from a blank slate?weight 3
Answer key — what a strong answer shows
A maintained, architecture-specific threat library meaningfully accelerates modeling versus starting from a blank slate every time; ask how the library is kept current.
baselineRFPExplain how the platform supports compliance-driven threat modeling requirements (e.g., PCI DSS, medical device security, automotive ISO 21434) — does it map identified threats to specific regulatory control requirements automatically?weight 3
Answer key — what a strong answer shows
Automatic mapping to named regulatory frameworks is stronger evidence of production maturity than generic threat output the compliance team must manually cross-reference.
baselineRFIHow does the platform handle collaborative threat modeling sessions (multiple stakeholders — dev, security, product — contributing simultaneously), and is there a structured facilitation workflow or just a shared canvas with no process guidance?weight 3
Answer key — what a strong answer shows
Structured facilitation (guided prompts, role-based input, session tracking) produces materially better threat models than an unguided shared whiteboard that depends entirely on facilitator skill.
baselineRFIWhat is the pricing model — per service/model, per developer seat, or a flat enterprise tier — and how does cost scale as the number of modeled services grows across a large microservices architecture?weight 3
Answer key — what a strong answer shows
Look for transparent, predictable scaling economics tied to a realistic large-microservices-architecture scenario, not just a per-model price that becomes expensive at real organizational scale.
baselineRFPWhen a real security incident occurs, does the platform support retroactively checking whether the exploited attack path was already identified in an existing threat model (validating or invalidating the model's predictions), closing the loop between predicted and actual threats?weight 3
Answer key — what a strong answer shows
This closed-loop validation is a genuinely valuable, distinct capability from initial threat-model generation — ask for a concrete example of a real incident being cross-referenced against an existing model.
baselineRFIDetail historical trend reporting on threat-modeling program coverage (percentage of the organization's service inventory with an up-to-date threat model) over time, suitable for demonstrating program maturity to leadership.weight 3
Answer key — what a strong answer shows
Trend-over-time coverage reporting is a distinct capability from individual threat-model documents — confirm this exists as a maintained, exportable report.
baselineRFPWho within the organization gets access to completed threat models, and is there role-based access control given that a threat model is essentially a documented map of a system's specific weaknesses if it fell into the wrong hands?weight 3
Answer key — what a strong answer shows
A threat model is uniquely sensitive — it's an explicit map of where an attacker should look — role-based access control over this specific artifact is an often-overlooked consideration.
baselineRFIHow does the platform integrate with real SAST/DAST/pentest findings — can an actual discovered vulnerability be automatically cross-referenced against the predicted threats in an existing model to validate or refine it?weight 3
Answer key — what a strong answer shows
Cross-referencing real findings against predicted threats is a genuinely valuable feedback loop that improves future threat-modeling accuracy — ask for a concrete example of this integration, not just standalone threat-model generation.
baselineRFIDoes the platform offer AI/LLM-assisted threat generation specifically (analyzing a system description or architecture and suggesting likely threats via a language model), distinct from rule-based/pattern-library threat generation, and what is the measured accuracy compared to expert-authored models?weight 3
Answer key — what a strong answer shows
AI-assisted threat generation is a genuinely emerging capability — ask for a specific accuracy comparison against expert-authored models, not just a claim that AI assistance exists.
baselineRFPWhat onboarding/training support exists for developers (not just dedicated security architects) to learn to threat-model their own services independently, and what is a customer-referenced measured reduction in security-team review bottleneck as a result?weight 3
Answer key — what a strong answer shows
Scaling threat modeling requires developers themselves to participate, not just a small central security team — ask for a real customer-validated bottleneck-reduction figure from developer self-service adoption.
baselineRFIFor regulatory requirements that mandate a specific threat-modeling methodology (e.g., automotive ISO 21434's specific approach), can the platform be configured to strictly follow that mandated methodology, or does it only support the vendor's own preferred general-purpose framework?weight 3
Answer key — what a strong answer shows
Some regulated industries mandate a specific methodology, not just 'a' threat-modeling approach — a vendor should give a specific answer on whether the mandated methodology is genuinely supported, not just a generic STRIDE/PASTA claim.
baselineRFPUse a threat modeling framework such as OWASP Top 10 or MITRE ATT&CK Framework.weight 3
baselineRFPProvide Application Threat Modeling and Design Reviews.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
