Guide · 7 min read
PASTA threat modeling: a risk-centric method in seven stages
A plain-language guide to PASTA (Process for Attack Simulation and Threat Analysis): its seven stages, when to use it instead of STRIDE, and what GRC teams get out of it.
STRIDE is great for asking “what could go wrong with this design?”. PASTA (Process for Attack Simulation and Threat Analysis) asks a bigger question: “which attacks matter most to this business, and how likely are they?”. It was published by Tony UcedaVélez and Marco Morana, and it is often described as risk-centric rather than design-centric.
The seven stages
- Define the objectives. Business goals, compliance requirements, data sensitivity and risk appetite for the application.
- Define the technical scope. Components, dependencies, infrastructure and third parties in scope.
- Decompose the application. Data flow diagrams, trust boundaries, users, roles and entry points.
- Analyse the threats. Use threat intelligence and incident history to see which threat actors and scenarios are realistic.
- Analyse vulnerabilities and weaknesses. Map known weaknesses (scan results, design flaws, code review findings) to the components.
- Model the attacks. Build attack trees or attack paths showing how a threat could exploit the weaknesses.
- Analyse risk and impact. Rate the residual risk and business impact, and recommend countermeasures in priority order.
When to choose PASTA
- High-value systems where leadership needs risk in business terms, such as payment platforms or patient data systems.
- When you already have threat intelligence, vulnerability data and a risk methodology to plug in.
- When the output must feed the enterprise risk register, not only an engineering backlog.
For a small feature change, STRIDE is usually enough. Many teams use STRIDE inside stage 4 or 5 of PASTA.
Why GRC teams like it
Stage 1 forces the conversation about business objectives and risk appetite up front, and stage 7 produces risk statements that fit straight into a risk register. That makes the result easier to defend to a risk committee or an auditor, because every recommendation traces back to a business objective and a realistic threat.
Common pitfalls
- Skipping stage 1 and treating PASTA as a long checklist.
- Using generic threat lists instead of intelligence relevant to your sector.
- Producing a large report that nobody turns into owned, dated actions.