Threat Modeling Calculator

Score a threat with DREAD and a STRIDE category, and get a CVSS-comparable severity plus a remediation window.

About Threat Modeling Calculator

DREAD averages five 0–10 ordinals into one comparable number, then compensating controls and asset criticality adjust it into a residual score banded on the CVSS thresholds — 9.0+ Critical, 7.0+ High, 4.0+ Medium. STRIDE is orthogonal: it does not change the score, it tells you which control family fixes the threat. This is a prioritisation estimate for triage order, not an assurance that the threat is or is not exploitable. Threat models stall on argument about which finding matters most; a scored, mitigation-adjusted list turns that into a queue with dates against it.

Formulas

Threat Modeling

DREAD = mean(Damage, Reproducibility, Exploitability, AffectedUsers, Discoverability) on 0–10; residual = DREAD × (1 − mitigationStrength) × assetCriticality.

Damage: Worst-case harm if exploited
Reproducibility: How reliably the attack works
Exploitability: Skill and tooling needed
Discoverability: How easily an attacker finds it
assetCriticality: Multiplier for where the asset sits

STRIDE to control mapping

STRIDE names the property being violated, which selects the control family: spoofing → authentication, tampering → integrity, repudiation → audit, disclosure → confidentiality, DoS → availability, elevation → authorisation.

STRIDE: Microsoft's six threat categories

Worked example

With the default values below, Threat Modeling Calculator returns Severity Rating of Medium. Change any input above and every figure here is recalculated in your browser.

Inputs used

STRIDE categoryone of Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, Elevation of privilege: Tampering with data
Damage potentialone of Nothing — 0, Individual user data leaked — 5, Sensitive data or partial system compromise — 8, Complete system or data destruction — 10: Sensitive data or partial system compromise — 8
Reproducibilityone of Very hard, even with knowledge — 0, Needs a specific timing window or race — 5, Reproducible most of the time — 8, Reproducible every time — 10: Reproducible most of the time — 8
Exploitabilityone of Advanced skills and custom tooling — 2, Available tooling and some skill — 6, Public exploit or a web browser — 9, Trivial, no tooling required — 10: Available tooling and some skill — 6
Affected usersone of None — 0, A few individual users — 3, Some users or one tenant — 7, All users — 10: Some users or one tenant — 7
Discoverabilityone of Very hard to find — 1, Needs deep inspection of traffic or code — 5, Visible in published documentation or errors — 8, Obvious in the address bar or a form — 10: Visible in published documentation or errors — 8
Existing mitigation strengthaccepts 0–100 %: 30 %
Asset criticalityone of Development or test — 0.6×, Internal business system — 1.0×, Customer-facing production — 1.2×, Regulated or safety-critical — 1.4×: Customer-facing production — 1.2×

Results

Severity Rating: Medium
DREAD Score: 7.40 / 10
Residual Score After Mitigation: 6.22 / 10
CVSS-Equivalent Severity: 6.2 / 10
STRIDE Control Focus: Integrity — signing, hashing and server-side validation
Suggested Remediation Window: 90 days

Step by step

1Values used
2Threat Modeling
3STRIDE to control mapping
4Severity Rating= Medium
5DREAD Score= 7.40 / 10
6Residual Score After Mitigation= 6.22 / 10
7CVSS-Equivalent Severity= 6.2 / 10
8STRIDE Control Focus= Integrity — signing, hashing and server-side validation
9Suggested Remediation Window= 90 days

Assumptions and limits

The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Threat Modeling calculated?

DREAD = mean(Damage, Reproducibility, Exploitability, AffectedUsers, Discoverability) on 0–10; residual = DREAD × (1 − mitigationStrength) × assetCriticality. DREAD averages five 0–10 ordinals into one comparable number, then compensating controls and asset criticality adjust it into a residual score banded on the CVSS thresholds — 9.0+ Critical, 7.0+ High, 4.0+ Medium. STRIDE is orthogonal: it does not change the score, it tells you which control family fixes the threat. This is a prioritisation estimate for triage order, not an assurance that the threat is or is not exploitable.

Why does Threat Modeling matter?

Threat models stall on argument about which finding matters most; a scored, mitigation-adjusted list turns that into a queue with dates against it.

What values do I need to enter?

This calculator takes 8 inputs: STRIDE category, Damage potential, Reproducibility, Exploitability, Affected users, Discoverability, Existing mitigation strength, Asset criticality. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is DREAD not considered obsolete?

Its weakness is inconsistency between raters, which is why this model constrains every factor to fixed ordinal options rather than free scoring. Used that way it is fast and repeatable, which is what a design-time threat model needs — reserve full CVSS for confirmed vulnerabilities.

Why does mitigation reduce rather than remove the score?

Because compensating controls fail, get misconfigured or are bypassed. Reducing the score keeps the threat on the register with a lower priority, which is honest; removing it makes the threat invisible the day the control lapses.