STRIDE is a threat modeling framework developed at Microsoft in 1999 that categorizes security threats into 6 types, Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege, and it appears directly on CISSP, SC-100, and SecurityX exam objectives as the standard method for identifying threats during system design.
STRIDE at a Glance
| Letter | Threat Category | Security Principle Violated |
| S | Spoofing | Authenticity |
| T | Tampering | Integrity |
| R | Repudiation | Non-repudiation |
| I | Information Disclosure | Confidentiality |
| D | Denial of Service | Availability |
| E | Elevation of Privilege | Authorization |
Each STRIDE category maps directly to the security principle it threatens. This 1-to-1 mapping is exactly why STRIDE shows up so consistently on certification exams: it gives you a memorable, testable link between an attack type and the defense goal it undermines.
Who Created STRIDE and Why
Loren Kohnfelder and Praerit Garg developed STRIDE at Microsoft in 1999 to give development teams a structured, repeatable way to identify threats during the design phase, before code was written, rather than discovering vulnerabilities after deployment. It builds on analysis of data-flow diagrams, breaking a system down into processes, data stores, data flows, and trust boundaries, then asking which STRIDE threats apply at each point.
The 6 STRIDE Categories Explained
| Category | What It Means | Example Attack |
| Spoofing | An attacker impersonates another user or system | Using stolen credentials to log in as someone else |
| Tampering | An attacker alters data or code without authorization | Modifying a file in transit between client and server |
| Repudiation | An attacker denies having performed an action, and the system cannot prove otherwise | Deleting logs after making unauthorized changes |
| Information Disclosure | Sensitive information is exposed to someone who should not see it | A misconfigured database exposing customer records |
| Denial of Service | An attacker makes a system or resource unavailable to legitimate users | Flooding a web server with traffic until it crashes |
| Elevation of Privilege | An attacker gains capabilities beyond what they were authorized for | Exploiting a bug to go from standard user to administrator |
How to Apply STRIDE: The Basic Process
| Step | What You Do |
| 1. Diagram the system | Build a data-flow diagram showing processes, data stores, data flows, and trust boundaries |
| 2. Identify elements | List every process, data store, external entity, and data flow in the diagram |
| 3. Apply STRIDE per element | For each element, ask which of the 6 STRIDE threats could apply to it |
| 4. Document threats | Record every plausible threat, even ones that seem unlikely, for later prioritization |
| 5. Prioritize and mitigate | Rank threats by impact and likelihood, then design or apply mitigations |
This process is commonly called STRIDE-per-Element. A single web application login page might generate 15 to 20 distinct threats once you walk through all 6 categories against every element in its data flow, which is exactly why the exercise works better as a structured walkthrough than an unstructured brainstorm.
STRIDE Mapped to Common Mitigations
| Threat | Typical Mitigation |
| Spoofing | Strong authentication, multi-factor authentication, digital signatures |
| Tampering | Digital signatures, hashing, access controls, integrity checks |
| Repudiation | Secure logging, digital signatures, audit trails |
| Information Disclosure | Encryption, access controls, data classification |
| Denial of Service | Rate limiting, redundancy, filtering, resource quotas |
| Elevation of Privilege | Least privilege enforcement, input validation, sandboxing |
Notice that several mitigations, like digital signatures and access controls, address more than one STRIDE category. This overlap is intentional and useful: a well-designed control often reduces your exposure across multiple threat types at once.
STRIDE vs Other Threat Modeling Frameworks
| Framework | Approach | Best For |
| STRIDE | Threat categorization by type, applied per system element | Software and system design, most widely taught |
| DREAD | Risk scoring model, rates threats by Damage, Reproducibility, Exploitability, Affected users, Discoverability | Prioritizing threats after STRIDE identifies them |
| PASTA | 7-stage, risk-centric methodology tied to business impact | Enterprise risk management, attacker-centric analysis |
| VAST | Scales threat modeling across agile development pipelines | Large organizations running continuous development |
STRIDE and DREAD are frequently used together: STRIDE identifies what could go wrong, and DREAD scores how badly it would hurt if it did. Most certification exams treat this pairing as standard practice rather than as 2 competing frameworks.
Where STRIDE Shows Up on Security Certification Exams
| Certification | How STRIDE Appears |
| CISSP | Domain 3, Security Architecture and Engineering, covers threat modeling methodologies including STRIDE |
| SC-100 | Cybersecurity Architect Expert exam includes threat modeling as part of designing security strategy |
| CompTIA SecurityX | Covers threat modeling frameworks within its architecture and engineering domain |
| CSSLP | Secure software development lifecycle content includes STRIDE as a standard design-phase practice |
If you are studying for CISSP specifically, understanding STRIDE well enough to apply it to a sample data-flow diagram, not just recite the acronym, is what separates candidates who recognize the concept from candidates who can actually answer scenario-based questions about it. For the broader architecture and design context STRIDE sits inside, see our CISSP vs CEH comparison if you are still deciding which security certification path fits your goals.
Common STRIDE Mistakes on Exams and in Practice
Memorizing the acronym without understanding the underlying security principle each letter maps to. Exam questions rarely ask you to just recite Spoofing, Tampering, Repudiation. They ask you to identify which STRIDE category a described attack scenario falls into, which requires understanding the principle, not just the word.
Applying STRIDE only to the whole system instead of per element. A system-level pass misses threats that only become visible when you walk through each individual data flow and trust boundary separately.
Confusing STRIDE with DREAD. STRIDE identifies threat types. DREAD scores risk severity. They solve different problems and exam questions test this distinction directly.
Treating threat modeling as a one-time exercise. Real threat models get revisited as a system changes, and exam scenarios increasingly test whether you understand threat modeling as an ongoing process rather than a single early-design checkbox.
Skipping trust boundaries in the data-flow diagram. Trust boundaries, the points where data crosses between zones of differing trust, are where the most exploitable threats tend to concentrate, and omitting them from your diagram weakens the entire exercise.
Practical STRIDE Tools
| Tool | Type |
| Microsoft Threat Modeling Tool | Free, diagram-based, generates STRIDE threats automatically per element |
| OWASP Threat Dragon | Free, open-source, web and desktop threat modeling tool |
| IriusRisk | Commercial, integrates threat modeling into development pipelines |
| Threats Manager Studio | Commercial, extensible threat modeling platform |
The Microsoft Threat Modeling Tool remains the most commonly referenced tool in exam prep materials specifically because it was built around STRIDE natively, generating a threat list automatically once you diagram your system’s processes, data stores, and trust boundaries.
FAQs
What does STRIDE stand for?
Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Each represents a distinct category of security threat.
Who invented the STRIDE threat model?
Loren Kohnfelder and Praerit Garg developed STRIDE at Microsoft in 1999 as a structured method for identifying security threats during system design.
Is STRIDE tested on the CISSP exam?
Yes. STRIDE and other threat modeling methodologies fall under Domain 3, Security Architecture and Engineering, and candidates should understand how to apply STRIDE to a described scenario, not just recall the acronym.
What is the difference between STRIDE and DREAD?
STRIDE identifies and categorizes threats by type. DREAD scores the risk severity of threats already identified, rating Damage, Reproducibility, Exploitability, Affected users, and Discoverability. They are commonly used together.
Do I need a diagram to apply STRIDE?
A data-flow diagram is the standard input for STRIDE analysis, since the framework works by examining each process, data store, data flow, and trust boundary in that diagram individually.
Is STRIDE still relevant in 2026?
Yes. STRIDE remains the most widely taught threat modeling framework across security certifications and is actively supported by current tools like the Microsoft Threat Modeling Tool and OWASP Threat Dragon.
What is STRIDE-per-Element?
A methodology where you apply all 6 STRIDE categories individually to each element in your data-flow diagram, rather than considering the system only as a whole. It produces a more complete threat list.
Can STRIDE be used for non-software systems?
Yes, though it originated for software architecture. The same categorization logic applies to any system with identifiable processes, data flows, and trust boundaries, including cloud infrastructure and enterprise networks.
Is STRIDE covered on Microsoft’s SC-100 exam?
Yes. SC-100, the Cybersecurity Architect Expert certification, includes threat modeling as part of designing an overall security strategy across an organization’s Microsoft environment.
What tool should I use to practice STRIDE for exam prep?
The Microsoft Threat Modeling Tool is free and was built specifically around STRIDE, making it the most commonly recommended starting point for candidates who want hands-on practice before their exam.
