mediumConceptScenarioSeniorStaff
How do you know when a threat model has gone stale, and how would you catch it before an incident does?
A threat model goes stale when architecture, trust boundaries, dependencies, data flows or abuse assumptions change. The fix is event-driven review triggers in design and delivery workflows, not a calendar reminder that ignores real system change.
4 min readUpdated 2026-08-15
Answer
Short answer
A threat model is stale when its diagram or assumptions no longer match production. Refresh it after new integrations, changed trust boundaries, new sensitive data, authentication changes, dependency swaps, incident lessons or major deployment topology changes.
Was this answer helpful?
Likely follow-ups
- What specific architectural changes would you configure as automatic triggers for a re-review?
- How would you catch a threat model going stale in a team too small to have a dedicated security review step?
- What is the difference between a threat model being stale and being wrong?
- How would you retrofit a review trigger into a project that has never had one?
Related questions
- You've run a threat model and found real issues, but engineering leadership says the roadmap has no room this quarter. How do you get the fixes prioritised?mediumAlso on threat-modeling and appsec3 min
- Walk me through applying STRIDE to the boundary where our order service calls the payments service over the network.mediumAlso on threat-modeling and appsec4 min
- You are told there is a memory-safety bug somewhere in a large C or C++ codebase, and you cannot read all of it. How do you narrow the search?hardAlso on appsec5 min
- You are accepting webhooks from two hundred partners. Threat model the ingestion pipeline - what are you actually defending against, and what does the endpoint have to do before it trusts a payload?hardAlso on threat-modeling4 min