Threat modelling for pentests

Why this matters

Before you start testing, you threat-model: what are the attacker's likely goals (data theft, ransomware, fraud), what paths get there, what does success look like. The threat model focuses your time on what matters; otherwise you spend 4 days on theoretical XSS and miss the unauthenticated SSRF that drains the cloud.

Demo

For a SaaS pentest, attacker goals: (1) read other customers' data, (2) compromise the platform admin, (3) exfil source/configs, (4) extort via ransomware. For each, sketch the most likely paths. Prioritise paths the existing controls don't address.

Try it yourself

1. For a target you'd test, list the attacker's top 3 goals.
2. For each, draw the most likely attack chain.
3. Allocate engagement time proportional to risk; not all chains deserve equal effort.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain pentest-time threat modelling.

2. Why it works (the mechanism)

Walk me through threat-modelling a SaaS pre-engagement.

3. Advanced — application & what's next

Design a threat model template you'd use across multiple pentests.

References

• OWASP — Threat Modeling
• PTES — Threat Modeling section