Threat modeling is a structured exercise to identify, before a system is built or changed, what could be attacked, how and with what impact, and to decide which controls prevent it. For example, when designing a customer portal, the team reviews how users authenticate and where their data travels. It should be repeated whenever the system changes.
How TecnetOne handles it: Cybersecurity Consulting
threat model, STRIDE, secure design review, design-phase risk analysis
Related terms
SAST and DAST
SAST (static application security testing) reviews an application's source code without running it to find flaws such as hardcoded passwords or unvalidated input. DAST (dynamic application security testing) tests the running application from the outside, the way an attacker would. They complement each other: SAST catches flaws early in development and DAST shows which ones are exploitable.
End of life (EOL)
End of life (EOL) is the date after which a vendor stops releasing updates and security patches for a piece of software or hardware. The product keeps working, but newly discovered flaws are no longer fixed. Windows 10, for example, reached end of support on October 14, 2025, except for organizations enrolled in Extended Security Updates (ESU).
Gap analysis
A gap analysis is an assessment that compares a company's current security posture with the requirements of a standard or target, such as ISO 27001 or PCI DSS (Payment Card Industry Data Security Standard), to identify missing or incomplete controls. The result is a prioritized action list and a starting point for planning a certification.
ISO 27701
ISO/IEC 27701 is an international standard for managing the privacy of personal data within an organization. It began as an extension of ISO 27001 and adds controls for those who decide how data is used (controllers) and those who process it on their behalf (processors). It helps demonstrate sound privacy practices under laws such as the EU General Data Protection Regulation (GDPR).
ISO 22301
ISO 22301 is the international standard that sets the requirements for a business continuity management system (BCMS), meaning how a company prepares to keep operating during a disruption and recover afterward. It is certifiable and includes business impact analysis, continuity plans and regular exercises, such as simulating an outage of the primary data center.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.