Threat Modeling
A structured way to find what can go wrong in a system before an attacker does, by reasoning about assets, entry points, and adversaries.
Thinking Like an Attacker, On Purpose
Threat modeling is the disciplined practice of identifying, for a given system, what is worth protecting, who might attack it, how they could, and what to do about it. It is done during design, when changes are cheap, and revisited as the system evolves. The output is a prioritized list of threats and the mitigations chosen for each.
The Four Questions
- What are we building? Diagram the system and its data flows
- What can go wrong? Enumerate threats against each element
- What are we going to do about it? Choose mitigations
- Did we do a good job? Validate the model against reality
STRIDE
A common taxonomy is STRIDE, which prompts analysts to consider six categories of threat for each component: Spoofing identity, Tampering with data, Repudiation of actions, Information disclosure, Denial of service, and Elevation of privilege. Walking each data flow through STRIDE surfaces threats that intuition alone would miss.
Trust Boundaries
The heart of a threat model is the trust boundary: the line where data crosses from a less trusted zone to a more trusted one. Every crossing is where validation, authentication, and authorization must happen. Drawing these boundaries accurately is often the most valuable part of the exercise.
Fusion Context
For a fusion plant, threat modeling covers both cyber and physical: who could reach a magnet controller, how a fueling command could be spoofed, what a compromised historian could hide. The Hyperion breeder and burner designs use threat modeling to place safety instrumentation outside the reach of any single compromised zone, so that even a successful intrusion cannot drive the machine past a hardware protection limit. This work is done in the current design phase, ahead of the Q2 2027 construction start.