Most threat modeling frameworks are built for security engineers — not for teams.
STRIDE requires data flow diagrams. PASTA requires attack simulation. OWASP TM requires technical notation. All start with threats — which means reviews never get done unless a specialist runs them.
The gap: Any product team can describe what their system owns in five minutes. They cannot draw a DFD or enumerate trust boundaries. A-SDF asks a different first question — "what does this system own?" — before asking what can go wrong. That one change makes security design reviews accessible to every stakeholder in an SDLC.
Built for every role in a modern SDLC.
A-SDF does not require a security background to run. If you can describe what your system does, you can run a review.
Run a review when any of these happen.
A-SDF is designed for real SDLC cadences — not once-a-year compliance exercises.
Works across every modern solution type.
The same methodology regardless of technology stack. The asset domains adapt to the solution — the method never changes.
One reasoning model. Every solution type.
Every abuse case — across Web Apps, SaaS, Cloud, and GenAI — derives from a single pattern.
Five asset domains. Every review starts here.
Every system can be decomposed into five domains. Identifying assets before threats is what makes A-SDF different from every existing methodology.
A threat model table. Directly actionable.
The output of every A-SDF review is a four-column table — Asset, Abuse Case, Preventive Control, Detective Control. One row per abuse case. No risk scores. No gap columns.
| Asset | Abuse Case | Preventive Control | Detective Control |
|---|---|---|---|
| User | Unauthenticated · AccessAn unauthenticated caller requests a one-time code without identity verification, gaining access to another user's password reset flow. | Verify caller identity via registered phone number before any OTP is issued. Unverified callers receive nothing. | Log all OTP generation events with caller identity and timestamp. Alert on repeated requests for the same account within a 10-minute window. |
* A full review covers all five asset domains — typically 12–18 rows. Downloadable as PDF or Word.
How A-SDF compares to existing approaches.
A-SDF is an independent methodology. It does not extend or layer on existing frameworks.
| Dimension | A-SDF | STRIDE | OWASP TM |
|---|---|---|---|
| Starting point | Assets the system owns | Data flow diagrams | Application attack surfaces |
| First question | "What does this system own?" | "Where are our trust boundaries?" | "What are our attack surfaces?" |
| Controls in output | Yes — preventive and detective per abuse case | No — threat list only | Partial — via external cheat sheets |
| Diagrams required | None | DFD mandatory | Architecture diagram required |
| Who can run it | Any SDLC stakeholder | Security engineers only | Security engineers only |
| GenAI support | Native — Intelligence asset domain | Not designed for LLM scope | Limited — separate LLM Top 10 track |
Common questions.
Run your first review — free.
4 threat models per month. No credit card required.
Start at threatmodeling.in → © 2026 Lokesh Ranjan · A-SDF is original intellectual property · All rights reserved