Review: Threat Modeling - A practical guide for development teams

While at OWASP Global AppSec EU 2026 in Vienna a couple of months ago, I picked up a copy of Izar Tarandach’s and Matthew J. Coles’ book “Threat Modeling: A Practical Guide for Development Teams”. I had dabbled into the topic from time to time but only very shallowly, and now I wanted to learn more.

The book is roughly split into these six sections:

1. General introduction into data flow diagrams, etc., for system modelling
2. How threat modelling works in general
3. Introduction to various methodologies like STRIDE
4. Automated threat modelling
5. Continuous threat modelling
6. Your role as a champion for threat modelling

There is a lot being covered here with some very good introductions, especially around system modelling tools and going beyond manual and static approaches. Unfortunately, the third chapter introducing various methodologies is the longest but also the one where I got the least out of. It was great to learn that there isn’t just one approach, but I felt like going into some detail on so many of them wasn’t practical. In fact, it brought my reading nearly to a halt.

Luckily, I pushed through because on the other end of the spectrum were chapters about automated and continuous threat modelling, which tackle problems around system modelling and documentation in general that I see every single day. Both show some actual approaches that might help there.

Some parts of all three chapters could be simple lists of links or “further reading” sections, though, to make them more “evergreen”.

Due to my experience with chapter three, I will need to do a lot of re-reading over the later chapters the next time I’ll do some modelling. As I wrote above, I think there is a lot in here. I just wish I would have done a more selective read instead of going straight from front to back.