Review: Threat Modeling - A practical guide for development teams

While at OWASP Global AppSec EU 2026 in Vienna a couple of months ago, I picked up a copy of Izar Tarandach’s and Matthew J. Coles’ book “Threat Modeling: A Practical Guide for Development Teams”. I had dabbled into the topic from time to time but only very shallowly, and now I wanted to learn more. The book is roughly split into these six sections: General introduction into data flow diagrams, etc., for system modelling How threat modelling works in general Introduction to various methodologies like STRIDE Automated threat modelling Continuous threat modelling Your role as a champion for threat modelling There is a lot being covered here with some very good introductions, especially around system modelling tools and going beyond manual and static approaches. Unfortunately, the third chapter introducing various methodologies is the longest but also the one where I got the least out of. It was great to learn that there isn’t just one approach, but I felt like going into some detail on…