Threat Modeling Calculator

Score a threat with DREAD and a STRIDE category, and get a CVSS-comparable severity plus a remediation window.

Inputs

STRIDE category

Damage potential

Reproducibility

Exploitability

Affected users

Discoverability

Existing mitigation strength%

Compensating controls already in place

Asset criticality

Severity Rating

Medium

DREAD Score

7.40/ 10

Residual Score After Mitigation

6.22/ 10

CVSS-Equivalent Severity

6.2/ 10

STRIDE Control Focus

Integrity — signing, hashing and server-side validation

Suggested Remediation Window

90days

Step by step

Values used
STRIDE category = Tampering with data; Damage potential = Sensitive data or partial system compromise — 8; Reproducibility = Reproducible most of the time — 8; Exploitability = Available tooling and some skill — 6; Affected users = Some users or one tenant — 7; Discoverability = Visible in published documentation or errors — 8; Existing mitigation strength = 30 %; Asset criticality = Customer-facing production — 1.2×
Threat Modeling
DREAD = mean(Damage, Reproducibility, Exploitability, AffectedUsers, Discoverability) on 0–10; residual = DREAD × (1 − mitigationStrength) × assetCriticality.
STRIDE to control mapping
STRIDE names the property being violated, which selects the control family: spoofing → authentication, tampering → integrity, repudiation → audit, disclosure → confidentiality, DoS → availability, elevation → authorisation.
Severity Rating
= Medium
DREAD Score
= 7.40 / 10
Residual Score After Mitigation
= 6.22 / 10
CVSS-Equivalent Severity
= 6.2 / 10
STRIDE Control Focus
= Integrity — signing, hashing and server-side validation
Suggested Remediation Window
= 90 days

How it works

DREAD averages five 0–10 ordinals into one comparable number, then compensating controls and asset criticality adjust it into a residual score banded on the CVSS thresholds — 9.0+ Critical, 7.0+ High, 4.0+ Medium. STRIDE is orthogonal: it does not change the score, it tells you which control family fixes the threat. This is a prioritisation estimate for triage order, not an assurance that the threat is or is not exploitable. Threat models stall on argument about which finding matters most; a scored, mitigation-adjusted list turns that into a queue with dates against it.

Formulas

Threat Modeling

DREAD = mean(Damage, Reproducibility, Exploitability, AffectedUsers, Discoverability) on 0–10; residual = DREAD × (1 − mitigationStrength) × assetCriticality.

Damage: Worst-case harm if exploited
Reproducibility: How reliably the attack works
Exploitability: Skill and tooling needed
Discoverability: How easily an attacker finds it
assetCriticality: Multiplier for where the asset sits

STRIDE to control mapping

STRIDE names the property being violated, which selects the control family: spoofing → authentication, tampering → integrity, repudiation → audit, disclosure → confidentiality, DoS → availability, elevation → authorisation.

STRIDE: Microsoft's six threat categories

Frequently Asked Questions

How is Threat Modeling calculated?

DREAD = mean(Damage, Reproducibility, Exploitability, AffectedUsers, Discoverability) on 0–10; residual = DREAD × (1 − mitigationStrength) × assetCriticality. DREAD averages five 0–10 ordinals into one comparable number, then compensating controls and asset criticality adjust it into a residual score banded on the CVSS thresholds — 9.0+ Critical, 7.0+ High, 4.0+ Medium. STRIDE is orthogonal: it does not change the score, it tells you which control family fixes the threat. This is a prioritisation estimate for triage order, not an assurance that the threat is or is not exploitable.

Why does Threat Modeling matter?

Threat models stall on argument about which finding matters most; a scored, mitigation-adjusted list turns that into a queue with dates against it.

What values do I need to enter?

This calculator takes 8 inputs: STRIDE category, Damage potential, Reproducibility, Exploitability, Affected users, Discoverability, Existing mitigation strength, Asset criticality. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is DREAD not considered obsolete?

Its weakness is inconsistency between raters, which is why this model constrains every factor to fixed ordinal options rather than free scoring. Used that way it is fast and repeatable, which is what a design-time threat model needs — reserve full CVSS for confirmed vulnerabilities.

Why does mitigation reduce rather than remove the score?

Because compensating controls fail, get misconfigured or are bypassed. Reducing the score keeps the threat on the register with a lower priority, which is honest; removing it makes the threat invisible the day the control lapses.

You might also need

Attack Tree Complexity Calculator Kill Chain Coverage Calculator Overall Security Posture Calculator