Optimising Brightford Payments' threat modeling program across 300 microservices: on the left, a slice of the service map with its trust boundaries drawn — the internet edge, the third-party partner API, tenant isolation, and the boundary no model had drawn until an incident crossed it, now inventoried and owned — replacing 400 stale diagrams nobody used; on the right, the trust boundary loop of eight disciplines, inventory, semantics, elicitation, model as code, risk economics, mitigation, scaling and feedback from incidents; and a CI check that runs on every boundary change, updating the model, ranking the threats and verifying the mitigation with a test.

CY-EXPERT-006Expert Level · Threat Modeling

Threat Modeling at Scale — The Trust Boundary Loop

An expert-level, program-optimisation course in threat modeling at scale, centred on trust boundaries: inventorying every boundary across hundreds of services from the real service catalogue and dependency graph, making each boundary's enforcement and assumptions explicit, eliciting threats systematically across crossings, encoding models as pytm/threagile-style code that diffs and gates in CI, ranking threats by risk economics rather than a single brittle score, matching and verifying mitigations against real running controls, scaling the practice with tiered depth, templates, and champions, and closing the loop with feedback from incidents and authorized own-environment testing. Work the Trust Boundary Loop's eight disciplines as principal security architect at a 300-microservice fintech platform. Four hands-on activities in every lesson.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Inventory every trust boundary across a large, multi-service estate from the real service catalogue and dependency graph, with an owner on every boundary.
Make each boundary's actual enforcement and assumptions explicit, and trace identity and token scope as they propagate across crossings.
Elicit threats systematically across boundary crossings with STRIDE, attack trees, LINDDUN, and defensive use of ATT&CK/CAPEC, and encode the resulting models as version-controlled, CI-gated code.
Rank threats by real risk economics, design and verify mitigations matched to boundary type against running controls, scale the program by tiered depth, and close the loop with feedback from incidents and authorized testing.

Price:৳12,000