<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-threat-modeling-training
description: >-
  Design threat modeling training programs with maturity assessment and exercises.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - training
  - security-champions
  - maturity-model
  - workshops
  - exercises
  - skill-development
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - "T1195"
  - "T1199"
---

# Implementing Threat Modeling Training

## Overview

Scaling threat modeling across an organization requires structured training programs tailored
to different roles. This technique covers designing curricula for developers, security champions,
and architects — including hands-on exercises, maturity assessments, workshop facilitation
guides, and metrics for measuring training effectiveness.

Mode: `[MODE: ARCHITECT]` — Security education and organizational capability building.

## Prerequisites

- Organizational role definitions (developer, security champion, architect)
- Existing threat modeling process documentation
- Sample applications for hands-on exercises
- Python 3.10+

## Key Concepts

### Training Tracks

| Track | Audience | Duration | Depth |
|-------|----------|----------|-------|
| **Fundamentals** | All developers | 4 hours | STRIDE basics, DFD reading |
| **Practitioner** | Security champions | 2 days | Full threat modeling workflow |
| **Expert** | Architects, AppSec | 3 days | Advanced methods, tooling, facilitation |

### Maturity Model

| Level | Description | Indicators |
|-------|-------------|-----------|
| **1 — Ad Hoc** | No formal process | Inconsistent modeling |
| **2 — Defined** | Process documented | Templates and checklists exist |
| **3 — Managed** | Integrated into SDLC | Required per feature |
| **4 — Measured** | Metrics tracked | Defect density, coverage metrics |
| **5 — Optimized** | Continuous improvement | Feedback loops, automation |

### Exercise Types

- **Tabletop**: Walk through threat scenarios on paper
- **Live modeling**: Real-time DFD creation and STRIDE analysis
- **CTF-style**: Find threats in intentionally vulnerable designs
- **Peer review**: Review and improve existing threat models

## Workflow

### Step 1: Assess Current Maturity

```bash
node scripts/agent.js --action assess --input org_survey.json
node scripts/agent.js --action gaps --input assessment.json
```

### Step 2: Generate Training Plan

```bash
node scripts/agent.js --action plan --input requirements.json
node scripts/agent.js --action exercises --query practitioner
```

### Step 3: Track Progress

```bash
node scripts/agent.js --action report --input metrics.json --output report.json
```

## Verification

- [ ] Training tracks defined for all target audiences
- [ ] Hands-on exercises developed with realistic scenarios
- [ ] Maturity assessment completed with baseline score
- [ ] Training schedule published with enrollment tracking
- [ ] Post-training assessment measures knowledge retention
- [ ] Quarterly metrics reviewed: models produced, coverage, defect rates

## References

- [Threat Modeling Manifesto](https://www.threatmodelingmanifesto.org/)
- [OWASP Security Champions Guide](https://owasp.org/www-project-security-champions-guidebook/)
- [SAFECode — Fundamental Practices](https://safecode.org/resource-secure-development-practices/fundamental-practices-for-secure-software-development/)
- [BSIMM — Building Security In Maturity Model](https://www.bsimm.com/)
- [SAMM — Software Assurance Maturity Model](https://owaspsamm.org/)
