How to read this model

Each threat describes something that could go wrong, the components it applies to, how likely and how damaging it is, and what is being done about it.

Threat status

The status records how the team is handling a threat. Open threats are the ones that still need work: they are counted and ranked separately on the summary.

Status	Meaning	Open
unmanaged	No decision has been made about this threat yet.	Yes
partially mitigated	Some controls are in place, but the risk is still too high.	Yes
accepted	The team has decided to live with this risk.
transferred	Someone else handles this risk, such as an upstream project.
inform	Handled by telling users how to protect themselves.
avoided	The feature that caused the risk was left out or removed.
mitigated	Controls in place bring the risk down to an acceptable level.
out of scope	Outside what this threat model covers.

Risk

Risk is impact times likelihood. Impact runs from Low (1) to High (3) and likelihood from Very Low (1) to High (4), so risk runs from 1 to 12. Scores of 1–3 are low, 4–6 are medium, and 8–12 are high.

Impact \ Likelihood	Very Low (1)	Low (2)	Medium (3)	High (4)
High (3)	3 low	6 medium	9 high	12 high
Medium (2)	2 low	4 medium	6 medium	8 high
Low (1)	1 low	2 low	3 low	4 medium

After mitigations

Each threat can also record the impact and likelihood that remain once its mitigations are in place. The risk computed from those is the risk after mitigations, also called residual risk. When a threat records nothing different, it equals the original risk. Lists on this site put the highest risk after mitigations first. The residual risk note on a threat page explains what is left.

Mitigation status

Status	Meaning
implemented	In place.
optional	Available, but it has to be turned on or chosen.
proposed	Not in place yet. Being considered.

A mitigation marked has automated test names the test that checks it. The mitigation's page shows which test.

Where threats apply

A threat applies to the components its authors list for it, where listing a boundary covers every component inside it. It can also apply through component properties, such as whether a component is exposed to the network: then it applies to every component whose properties meet all of its requirements. Each threat page says which way it is matched under How this threat is matched. Scenarios show those components in context. The model internals pages show the rules themselves.