STRIDE — a vocabulary for threats

Why this matters

STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) is Microsoft's category framework for threats. It's not a deep theory — it's a vocabulary that lets a team enumerate threats without skipping classes. The discipline isn't memorising the letters; it's running through them deliberately for each component you ship.

Demo

Apply STRIDE to a POST /api/login endpoint and you immediately surface: Spoofing (credential stuffing), Tampering (injection), Repudiation (no audit), Information disclosure (timing oracle), DoS (rate of brute force), Elevation (post-auth IDOR). Each is a real category of work.

Try it yourself

1. Pick a HTTP endpoint in your codebase. For each STRIDE letter, write one concrete threat that applies.
2. For threats that don't apply, write why (e.g. 'Repudiation: every action goes through an audit log already').
3. Notice which STRIDE classes your codebase routinely under-invests in. That's your roadmap.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain STRIDE's six categories with one example per category.

2. Why it works (the mechanism)

Walk me through applying STRIDE to a microservices system: where do you draw the boundaries, and what do you analyse per boundary?

3. Advanced — application & what's next

Compare STRIDE to PASTA and LINDDUN. When does each give you a better signal?

References

• Microsoft — STRIDE
• Threat Modeling Manifesto