Skip to content
Scrollchart
Computing Medium #threat-modeling#stride

STRIDE Threat Model

Spoofing, Tampering, Repudiation, Info disclosure, DoS, Elevation. Six lenses on every component.

A free, animated stride threat model you can read here or embed on any website, from Scrollchart.

STRIDE Threat Model

STRIDE Threat ModelSix threat categories applied to every component and data flow in the systemDATA-FLOW DIAGRAMTrust Boundary: server infrastructureBrowser ClientAPI ServerDatabaseIdentity ProviderHTTPS requestSTISQL queryTIEToken verifySRTHREAT CATALOGSSpoofingAuthentication (MFA, certificates)TTamperingIntegrity checks (HMAC, TLS, signing)RRepudiationAudit logging, signed assertionsIInfo DisclosureEncryption at rest and in transitDDenial of ServiceRate limiting, autoscaling, CDNEElevation of PrivilegeLeast privilege, RBAC, input validationThreat modeling process1. Decompose: draw DFD with components, data flows, trust boundaries.2. Identify: apply STRIDE to each element. 3. Mitigate: map each threat to a control. 4. Validate: re-review after code changes.STRIDE was formalized at Microsoft in 1999. Every component that crosses a trust boundary is high-priority for all six categories.

A data-flow diagram with components, trust boundaries, and data flows. Each component is annotated with the relevant STRIDE threats. Mitigations attached per threat (auth, integrity, logging, encryption, throttling, least privilege).

Good for

  • Security architecture reviews for new services and APIs
  • Engineering blog posts on structured threat modeling for developers
  • Security training courses introducing threat modeling methodology

Source & accuracy

This stride threat model is an editorial illustration built to represent the concept accurately. Where it shows figures, they are typical or representative values chosen to make the relationship clear, not a single underlying dataset. The diagram and its explainer are reviewed and maintained centrally, and updated over time as understanding improves.

Six Categories of System Threats

STRIDE, developed by Microsoft, is a threat modeling framework that categorizes risks into six lenses: Spoofing identity (faking who you are), Tampering with data (modifying information), Repudiation (denying you did something), Information disclosure (leaking secrets), Denial of service (blocking access), and Elevation of privilege (gaining unauthorized authority).

For each component in a system (a service, database, API endpoint, user), a STRIDE analysis asks: can someone spoof this? Tamper with it? Repudiate their actions? Disclose its data? Deny service to it? Elevate their privilege through it? This systematic inquiry forces teams to think like attackers and surface assumptions about trust.

Prioritizing by Severity

Not all threats carry equal weight. Information disclosure of a public dataset is low-severity; elevation of privilege to database admin is critical. STRIDE provides a common vocabulary for security teams, architects, and developers to assess risk together. A threat is only a problem if it's both plausible in your architecture and consequential to your users.

STRIDE is usually applied after drawing a data flow diagram: services, data stores, external actors, and trust boundaries. A single undefended boundary (e.g., a user-controlled HTTP header reaching a trusted service) can imply spoofing and tampering threats. The exercise trains teams to reason about threat surface early in design.

Embed this diagram

Add this animated stride threat model to your own site. Copy one line of HTML, or use the embed builder for theme and sizing options.

Reference

What this is
A free, embeddable, animated stride threat model for any website.
Who uses it
Security blogs, Developer blogs.
How to embed
Copy one line of HTML. No signup. No watermark. Works in WordPress, Webflow, Ghost, Substack, plain HTML.
File size
iframe embed, ~80 KB gzipped (loads on demand, does not block your page paint).
License
Free forever. Editorial explainer text included; updated centrally over time.
URL
scrollchart.com/diagram/threat-model-stride

Embed format options

Copy the universal HTML snippet, the WordPress shortcode, or an iframe fallback - see the WordPress plugin page for details. Any format keeps the same Core Web Vitals profile and the same explainer text.

Embed snippet 
<div data-scrollchart="threat-model-stride" data-scrollchart-v="1"></div>
<script src="https://scrollchart.com/embed.js" async></script>

By embedding, you acknowledge the diagram and explainer text are served from scrollchart.com and may be updated from time to time to reflect new research or to link to relevant sources within the explainer.

Frequently asked questions

Where can I get a free animated "STRIDE Threat Model" for my website?
Scrollchart provides "STRIDE Threat Model" as a free, embeddable animated diagram you can add to any website with one line of HTML. No signup is required and there is no watermark. The diagram and its explainer text are served from scrollchart.com, so the embed stays current without any maintenance on your end.
How do I embed a stride threat model in a developer or tech blog?
Copy the one-line snippet from the Scrollchart diagram page and paste it into your post HTML. It works in any static site generator, CMS, or hand-coded HTML page. The embed is a thin loader, not an iframe, so the content is fully in your DOM.
Related diagrams

Other computing explainers

See all computing →
Computing Medium

SQL Injection

Untrusted input concatenated into SQL becomes code. Parameterization is the cure.
Computing Medium

MFA & TOTP

Password is something you know. TOTP is something you have. Together: two factors.
Computing Medium

XSS: Cross-Site Scripting

Attacker-injected script runs in your origin. Steals tokens, defaces, pivots.