Stop hacking blindly. Start modelling.
Threat modelling is the missing link between the people who build systems and the people who break them. The Threat Modelling Village turns threat modelling from a documentation exercise into a hands-on, collaborative security activity where attackers, defenders, architects, developers and security practitioners work together to understand how real systems can fail before an attacker does.
At the Village, participants will learn the fundamentals of threat modelling and immediately put them into practice. Working in small teams, you will analyze realistic system architectures, identify threats and attack paths, challenge assumptions, and propose practical security mitigations. No lengthy reports required – just models, threats, attack paths and clarity of thought.
No previous threat modelling experience is required. Beginners are welcome; participants with existing threat modelling, AppSec, development, architecture, red-team or security experience are equally encouraged to join.
Goal
Goal of the Competition
- Understand the core principles of threat modelling and the 4-Question Framework.
- Learn how to read and reason about a system architecture from a security perspective.
- Work collaboratively to identify threats, attack paths and security weaknesses.
- Practise turning architectural observations into a concise, usable threat model.
- Challenge assumptions and learn how different security practitioners approach the same system.
- Take away practical techniques that can be applied to their own projects, architectures and security assessments.
Rules
- Equipment: A laptop, a willingness to learn, and a collaborative spirit.
- Group size: Approximately 8–10 participants per one-hour interval (for the competitive track), divided into smaller working groups where appropriate.
- Slots: Participants join at the beginning of an hourly interval. We will run two such slots per day. Pre-registration is required. Walk-ins are welcome subject to availability..
- Crash course: We will provide a crash course to threat modeling. Refer to schedule
- Challenge Format: Participants then work through a prepared system architecture, identifying threats, attack paths and potential mitigations in a short period of time.
- Background Activities in Village: Besides the Threat Modeling Challenge, we also host a “Wall of Threats” where participants may contribute findings, based on their interpretations of our challenge statements, and allow the wider community to gain a better appreciation of threats on such systems.
- At the stand: We will provide the prepared system architecture/challenge materials, threat-modelling templates and facilitator guidance.
PRIZES
TBD