Score a threat with DREAD and a STRIDE category, and get a CVSS-comparable severity plus a remediation window.
DREAD averages five 0–10 ordinals into one comparable number, then compensating controls and asset criticality adjust it into a residual score banded on the CVSS thresholds — 9.0+ Critical, 7.0+ High, 4.0+ Medium. STRIDE is orthogonal: it does not change the score, it tells you which control family fixes the threat. This is a prioritisation estimate for triage order, not an assurance that the threat is or is not exploitable. Threat models stall on argument about which finding matters most; a scored, mitigation-adjusted list turns that into a queue with dates against it.
Threat Modeling
DREAD = mean(Damage, Reproducibility, Exploitability, AffectedUsers, Discoverability) on 0–10; residual = DREAD × (1 − mitigationStrength) × assetCriticality.
STRIDE to control mapping
STRIDE names the property being violated, which selects the control family: spoofing → authentication, tampering → integrity, repudiation → audit, disclosure → confidentiality, DoS → availability, elevation → authorisation.
DREAD = mean(Damage, Reproducibility, Exploitability, AffectedUsers, Discoverability) on 0–10; residual = DREAD × (1 − mitigationStrength) × assetCriticality. DREAD averages five 0–10 ordinals into one comparable number, then compensating controls and asset criticality adjust it into a residual score banded on the CVSS thresholds — 9.0+ Critical, 7.0+ High, 4.0+ Medium. STRIDE is orthogonal: it does not change the score, it tells you which control family fixes the threat. This is a prioritisation estimate for triage order, not an assurance that the threat is or is not exploitable.
Threat models stall on argument about which finding matters most; a scored, mitigation-adjusted list turns that into a queue with dates against it.
This calculator takes 8 inputs: STRIDE category, Damage potential, Reproducibility, Exploitability, Affected users, Discoverability, Existing mitigation strength, Asset criticality. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Its weakness is inconsistency between raters, which is why this model constrains every factor to fixed ordinal options rather than free scoring. Used that way it is fast and repeatable, which is what a design-time threat model needs — reserve full CVSS for confirmed vulnerabilities.
Because compensating controls fail, get misconfigured or are bypassed. Reducing the score keeps the threat on the register with a lower priority, which is honest; removing it makes the threat invisible the day the control lapses.