DataAI Nexus

Agents / Skills

Lightweight Threat Model

Skill

Runs a threat-modelling session sized for real teams: what you are building, what can go wrong, what you will do about it — a structured hour that finds the design-level flaws code review cannot see.

Best for

  • New features touching money, data or access
  • Teams who know they should threat-model but found the frameworks heavy
  • Finding the flaw in the design while it is still a diagram

What you give it

  • The feature or system: its design, data flows and trust boundaries (it helps draw them)

What you get back

  • The model: assets worth attacking, entry points, trust boundaries — drawn and agreed
  • Threats enumerated systematically per boundary, each judged: real here, or not applicable, with reasons
  • The decisions: mitigate (how, who), accept (said aloud), or needs-design-change — ranked by risk

How it works

  1. Draws the system first: data flows, trust boundaries, entry points — most sessions find their first flaw during the drawing.
  2. Walks a threat checklist per boundary (spoofing, tampering, leaking, escalation, denial) asking 'how would this happen HERE?'
  3. Keeps altitude at design level: token lifetimes, trust decisions, data exposure — code bugs are for review and testing.
  4. Ends in decisions with names: every real threat gets mitigated, accepted aloud, or sent back to design — none evaporate into the minutes.

Example

You: Threat-model the new feature where accountants can be invited into client workspaces.

Result: The hour's haul: the invitation token judged (long-lived, email-borne, not bound to the invitee — redesigned to single-use, bound, expiring), the cross-tenant risk named (an accountant in forty workspaces is a concentration target — session and scoping decisions made), the audit question answered (client admins can see what the accountant touched), and two accepted risks written down as accepted, with names. The design changed twice during the session, which is the session working.

Limits — please read

  • A lightweight model finds design flaws; deep adversarial review of high-value targets is a bigger exercise it will recommend when warranted.
  • The model is as good as the drawn system's honesty — undrawn integrations are unmodelled threats.
  • Threats evolve; the model gets revisited when the design or the stakes change.