Local tool / threat modelling
Map the boundary.
Make the questions visible.
Start with a fictional SaaS, partner API or AI-agent architecture. Edit the system, record threats and export a working model. No diagram or input is uploaded.
LOCAL WORKING MODEL
No target scanning, cloud connection or automatic threat claim. Keep sensitive architecture in an approved private tool.
Choose a starter or edit the current fictional model.
01 / ARCHITECTURE
Components and trust boundaries
Activate a diagram component to reach its editable record below.
Components
Data flows
02 / THREAT REGISTER
Assumptions, threats and validation
Each record keeps the concern, proposed mitigation and follow-up separate. “Reviewed” is a user-entered work state, not verification.
From diagram to action.
Use the validation tasks to prepare an authorized review or add a scoped check to an assessment plan. A diagram alone does not establish security.
Open the pentest planner