Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams

Threat modeling advice often sounds simple until a development team tries to apply it to a real system. Izar Tarandach and Matt Coles join Chris and Robert to discuss their book, Threat Modeling: A Practical Guide for Development Teams, and the collaboration behind it. They explain how the book organizes system modeling, threat discovery, and mitigation into a usable workflow without forcing teams into one methodology. The conversation covers attack trees, LINDDUN, pytm, writing for different experience levels, and the role of empathy when introducing security practices. Their goal is practical: help teams make threat modeling part of software development instead of a specialist exercise performed once and forgotten.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Izar Tarandach and Matt Coles:
→ Izar Tarandach on LinkedIn
→ Matt Coles on LinkedIn
→ Threat Modeling: A Practical Guide for Development Teams

Mentioned in this episode:
→ Threat Modeling: A Practical Guide for Development Teams
→ OWASP pytm
→ Attack Trees
→ LINDDUN
→ Threat Modeling Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 A practical guide to threat modeling
02:00 How Izar and Matt approach the discipline
09:36 Why development teams needed this book
11:46 How the collaboration began
14:49 Writing practical guidance together
21:44 The book’s system-modeling foundation
26:03 Four parts of a repeatable workflow
29:17 Choosing methods without becoming dogmatic
31:38 Attack trees, LINDDUN, and other techniques
34:33 Applying the guidance to real teams
42:15 Empathy as a threat modeling skill
46:01 Using threat modeling beyond security