A threat model is a short structured answer to three questions: what is worth attacking, how would somebody attack it, and what stops them.
Most small teams never write one, not because it is hard but because a blank page is intimidating. VibeLock starts you from a draft built out of your profile, so the work is editing rather than inventing.
What it contains
- Assets
- What you hold that has value: user accounts, payment records, uploaded files, the model API key that bills to your card.
- Threats
- The STRIDE categories your profile makes applicable, expressed in terms of your application rather than as a taxonomy.
- Mitigations
- What stops each threat. Each mitigation names a control in the catalogue, and the document shows that control’s current state beside it.
Its standing
The threat model is a generated document, not a control. No published requirement in the ledger asks for one, so it earns nothing by existing. What makes it worth having is that every mitigation resolves to a control with a real state: a mitigation that points at a failed or not-yet-tested control is visibly a claim without evidence behind it.