Think Like the Attacker Before You Test (Threat Modelling)

Why this matters

Before you start testing, you threat-model: what are the attacker's likely goals (data theft, ransomware, fraud), what paths get there, what does success look like. The threat model focuses your time on what matters; otherwise you spend 4 days on theoretical XSS and miss the unauthenticated SSRF that drains the cloud.

Demo

For a SaaS pentest, attacker goals: (1) read other customers' data, (2) compromise the platform admin, (3) exfil source/configs, (4) extort via ransomware. For each, sketch the most likely paths. Prioritise paths the existing controls don't address.

Try it yourself

1. For a target you'd test, list the attacker's top 3 goals.
2. For each, draw the most likely attack chain.
3. Allocate engagement time proportional to risk; not all chains deserve equal effort.

References

• OWASP — Threat Modeling
• PTES — Threat Modeling section