BSides Munich 2026

This 8-hour Threat Modelling training is geared towards intermediate audiences with software engineering and security engineer/pentester backgrounds who have never done any sort of threat modelling work but are trying to get into it. However, it also has some modules that would help beginners to get to speed in threat modelling practically right after the training, so beginners are also welcomed for this type of training. Many cybersecurity practitioners are facing threat modelling requirements to be part of their jobs, but don't know where to start or how to do it, which this training focuses on arming them the knowledge and techniques to do it as practiced by the instructor in his security consultancy career. Practically, anyone can join this class even if they do not have those backgrounds, but at least some basic idea of how programs work on a code level, basic cybersecurity issues and threats and anybody interested in learning them.

The main goal of this training is to equip participants with understanding the importance of threat modelling in dealing and understanding cyber threats to their applications and networks. The trainer's goal is to prevent more software security bugs from inception by teaching students whether they build more secure software or find underlying security flaws and bugs and minimizing the risks and impact of the engineered software. Participants will be immersed with STRIDE, DREAD, PASTA and NIST methodologies for threat modelling and they will create their own threat models during the training. STRIDE and DREAD are the most common threat modelling methodologies which we will immerse on the first half of the day. In the remaining half, we will bring it higher to diving in PASTA which had become increasingly popular methodology asked of practitioners and consultants to present a different point of view of an organization's potential threats. We will also look at the NIST threat modelling methodology as another comparison. This class focuses on being technology-agnostic with threat modelling methodologies where threat modelling software, while would be useful, is not relevant to the main goal of the training.

At the end of the training, students shall expect themselves to be able to do a quick threat model of any function/method that they wish to implement in their software, AI systems, networks, cloud infrastructure and any information system, then realize the threats that they could introduce or deal with, and finally be able to write a full and complete threat model on their own from start to finish including recommendations, threat scenarios and related risk ratings from a score-based weighted risk approach.