AttackBranch - AI threat modeling
AttackBranchthreat modeling, automated
 home
Generate threat model
STRIDE · MITRE ATT&CK · OWASP

Threat modeling examples

Realistic threat models for common architectures. Each example lists the components in scope and the kinds of STRIDE threats a model surfaces. Open the full interactive sample or generate a model for any of these systems in one click.

Three-Tier Web Application

SPA, Node.js API, PostgreSQL, Redis, S3, Auth0, Stripe

full interactive modelModel this system

Customer-facing SPA backed by a Node.js API, PostgreSQL, Redis, S3, Auth0 IdP, and a Stripe webhook receiver behind a CDN/WAF.

components in scope

React SPANGINX reverse proxyNode.js APIPostgreSQLRedisS3 bucketAuth0 IdPStripe webhook receiver

threats a model surfaces

  • ▸Spoofed Stripe webhook events forging payment confirmations
  • ▸SQL injection through unsanitized API parameters
  • ▸Session token theft via XSS in the SPA
  • ▸Public S3 bucket exposure of user uploads
  • ▸Redis cache poisoning corrupting session state
  • ▸Webhook receiver replay and DoS attacks
S: SpoofingT: TamperingR: RepudiationI: Info DisclosureD: Denial of ServiceE: Elevation of Privilege

Multi-Tenant E-Commerce SaaS

GraphQL on ECS Fargate, RDS, DynamoDB, S3, Cognito, Stripe

Model this system

Multi-tenant e-commerce SaaS. React SPA + Node.js GraphQL API on AWS ECS Fargate behind ALB and CloudFront/WAF. PostgreSQL (RDS) for tenant data, DynamoDB for cart sessions, S3 for product images and merchant uploads, Redis (ElastiCache) for rate-limit counters. Auth via Cognito with social login. Stripe for payments via webhook receiver. Background workers consume SQS for order fulfilment, sending emails via SES. Admin panel is a separate Next.js app on the same domain under /admin.

components in scope

React SPA storefrontNode.js GraphQL APIPostgreSQL (RDS)DynamoDB cart sessionsS3 merchant uploadsCognito with social loginStripe webhook receiverSQS fulfilment workersNext.js admin panel

threats a model surfaces

  • ▸Cross-tenant data leakage via GraphQL resolver authorization gaps
  • ▸Insecure direct object references on merchant upload URLs
  • ▸Admin panel session fixation on shared domain cookies
  • ▸SQS message tampering triggering fraudulent fulfilment
  • ▸Cognito social login account linking attacks
  • ▸Rate-limit counter manipulation bypassing brute-force controls
S: SpoofingT: TamperingR: RepudiationI: Info DisclosureD: Denial of ServiceE: Elevation of Privilege

Internal RAG Chatbot

Next.js, FastAPI on GKE, Pinecone, OpenAI, Okta SAML

Model this system

Internal employee-facing RAG chatbot. Next.js frontend on Vercel, FastAPI backend on Kubernetes (GKE). Ingestion pipeline pulls from Confluence, Google Drive, and an internal Postgres knowledge base nightly via Cloud Run jobs, embedding with OpenAI ada-002 into a Pinecone vector DB. Auth via Okta SAML. Chat queries hit OpenAI GPT-4 with retrieved chunks. Conversation history stored in Postgres. No PII redaction at ingestion time.

components in scope

Next.js frontend (Vercel)FastAPI backend (GKE)Cloud Run ingestion jobsPinecone vector databaseOpenAI GPT-4 / ada-002Okta SAML IdPPostgres conversation historyConfluence / Drive connectors

threats a model surfaces

  • ▸Prompt injection via poisoned Confluence pages
  • ▸Indirect data exfiltration through crafted retrieval queries
  • ▸PII leakage from unredacted ingestion into embeddings
  • ▸Cross-user conversation history access in Postgres
  • ▸SAML assertion replay against the FastAPI ACS endpoint
  • ▸Over-privileged Drive connector OAuth scopes
S: SpoofingT: TamperingR: RepudiationI: Info DisclosureD: Denial of ServiceE: Elevation of Privilege

Industrial IoT Telemetry Platform

ESP32, MQTT over TLS, AWS IoT Core, Kinesis, Timestream

Model this system

Industrial IoT telemetry platform. Field devices (ESP32) push MQTT over TLS to AWS IoT Core. Rules engine forwards to Kinesis, then Lambda enriches and writes to Timestream. Operator web dashboard (Vue + Django REST API) reads aggregated data. Device provisioning via just-in-time registration with X.509 certs. Firmware OTA updates served from S3 signed URLs. Alerts pushed to PagerDuty webhook.

components in scope

ESP32 field devicesAWS IoT Core (MQTT/TLS)Kinesis data streamLambda enrichmentTimestream databaseVue + Django operator dashboardJIT X.509 device provisioningS3 signed-URL OTA firmware

threats a model surfaces

  • ▸Rogue device registration abusing JIT provisioning CA trust
  • ▸Unsigned or rollback firmware served via leaked S3 signed URLs
  • ▸MQTT topic wildcard subscription exposing other tenants' telemetry
  • ▸Telemetry spoofing corrupting operator dashboards and alerts
  • ▸PagerDuty webhook endpoint abuse injecting false alerts
  • ▸Device certificate extraction from physical hardware
S: SpoofingT: TamperingR: RepudiationI: Info DisclosureD: Denial of ServiceE: Elevation of Privilege

Model your own architecture

These examples were generated from a plain-English system description. Describe yours and get a full STRIDE threat model, attack tree, and mitigation roadmap in under a minute.

Generate a threat model