Public Threat Models: Analysis & Applications
- Public Threat Models (PTM) are public records detailing security assessments, anticipated threats, mitigations, and the limits of a design.
- They encompass privacy and participatory threat modeling approaches, integrating technical, regulatory, and human-centered insights.
- Effective PTMs require careful preparation, redaction, and regular updates to support informed security decisions and competitive differentiation.
Public Threat Models (PTM) are threat model documents published for external consumption that serve as the primary engineering record of the security analysis of a software or digital hardware design. In the most direct usage, a PTM describes what threats were anticipated by design, how potential threats are addressed, and the security properties and limits of the design. The acronym is also used in adjacent literatures for Privacy Threat Modelling and Participatory Threat Modeling, which extend threat modeling toward privacy requirements, human contexts, and public or reusable knowledge artifacts. This broader usage suggests a field organized around structured disclosure, traceability, and externally consumable threat knowledge rather than a single document genre (Kohnfelder et al., 11 Nov 2025, Gholami et al., 2016, Naidu et al., 2022, He et al., 9 Feb 2026).
1. Definition and terminological scope
The publication-centered definition treats a PTM as a public engineering artifact. A PTM may be a lightly edited version of an internal threat model or created specifically for public sharing. Its form can vary across analysis documents, security guides, and bug bounty rules, but the core requirement is that it describes anticipated threats, corresponding mitigations, and the security properties and limits of the design. The PTM need not be labeled as such; content is more critical than labeling. A suggested minimum structure is Adam Shostack’s Four Question Framework: “What are we working on?”, “What can go wrong?”, “What are we going to do about it?”, and “Did we do a good job?” (Kohnfelder et al., 11 Nov 2025).
Across the cited literature, the acronym “PTM” is used in multiple technically distinct ways:
| Usage of “PTM” | Core object | Representative papers |
|---|---|---|
| Public Threat Models | Public engineering record of security analysis | (Kohnfelder et al., 11 Nov 2025) |
| Privacy Threat Modelling | Privacy requirements, threats, and mitigations linked to architecture and regulation | (Gholami et al., 2016, Gangavarapu et al., 2020, Alalade et al., 24 Oct 2025, Naidu et al., 2022) |
| Participatory Threat Modeling | Human-centered workshops producing situated threat models | (He et al., 9 Feb 2026) |
This terminological multiplicity matters because some papers treat “public” as publication and disclosure, while others treat “public” as reusable datasets, public knowledge bases, public model hubs, or publicly available surrogate models. A plausible implication is that PTM has evolved from a documentation practice into a broader knowledge-organizing paradigm spanning disclosure, evaluation, and public safety.
2. Motivations, benefits, and regulatory drivers
The principal rationale for publishing PTMs is that customers of closed-source, and even open-source, products often cannot assess security claims without concrete and auditable security analysis. Published PTMs are presented as instruments for transparency and accountability, customer assurance, supply chain security, competitive differentiation, and reducing friction in procurement, integration, and third-party risk management. The cited benefits are partitioned by stakeholder: providers can demonstrate thoroughness, obtain feedback, reduce questionnaires and TPRM burdens, and use PTMs as a sales tool; customers can understand security properties quickly, evaluate compensating controls, and clarify vendor/customer responsibility boundaries; analysts and researchers gain a basis for independent security analysis and cross-industry learning; end users benefit indirectly when customer and procurement decisions become more informed (Kohnfelder et al., 11 Nov 2025).
The publication case is reinforced by precedent. Early adopters identified in the literature include Zero-Knowledge Systems, SecureDrop, Meta, Apple/Google, Kubernetes, cURL, HashiCorp, FIDO, NIST, Kata Containers, and Vault Secrets. In healthcare, Medical Device Makers already prepare threat models for regulators, and publication is presented as beneficial for procurement, deployment, operations, and decommissioning by Health Delivery Organizations. This suggests that PTM publication is not confined to one software subculture but already appears across regulated and infrastructure-heavy sectors (Kohnfelder et al., 11 Nov 2025).
Regulatory trends are treated as major drivers. The EU Cyber Resilience Act, effective 2027, requires inclusion of the cybersecurity risk assessment in the technical documentation for products with digital components and requires disclosure of known or foreseeable circumstances leading to significant cybersecurity risks. Australia’s “Secure by Demand” calls for full, detailed threat models as procurement requirements for operational technology. US medical device regulation is cited as a domain in which external threat-model provision is already normalized. The literature’s conclusion is that threat modeling will increasingly have to be externally consumable, which weakens the case for permanent non-disclosure (Kohnfelder et al., 11 Nov 2025).
A recurrent controversy concerns whether a PTM is “a roadmap for attackers.” The published counterposition is that if disclosure materially weakens the design, publication is exposing a real, unaddressed vulnerability rather than creating one. Related objections include reliance on NDA-only sharing, claims that customers only need assurance that threats are covered, and concerns about lack of standards. These objections are answered with appeals to the Open Design Principle, the practical limits of obscurity, and the argument that standardization should not delay disclosure (Kohnfelder et al., 11 Nov 2025).
3. Preparation, redaction, and lifecycle management
Internal threat models are not assumed to be directly suitable for disclosure. A practical preparation process is specified: collect internal documents; adjust detail and precision for external audiences; cull unrelated or internal-only sections; redact sensitive information; add context where redaction creates gaps; conduct a security review of publication implications; optionally standardize the format; edit and brand the artifact; and complete final review and sign-off involving legal, executive, and potentially customer stakeholders. The process is explicitly framed as adaptable rather than prescriptive (Kohnfelder et al., 11 Nov 2025).
The treatment of redaction is narrower than simple omission. Fully mitigated threats are expected to remain in the PTM to demonstrate diligence and avoid customer guesswork. Redacting implementation details is considered acceptable, including descriptions analogous to “Our Magic Security Dust blocks X,” but the mechanism should be described as much as possible without revealing trade secrets unless that detail is critical to security. Excessive redaction or omission is treated as dangerous because it can hide real threats publicly while leaving them present internally, creating reputational and security risk (Kohnfelder et al., 11 Nov 2025).
PTMs are also described as living documents. Updating is recommended when new features or architecture changes are introduced, when security incidents or new publicized threats arise, when new threats or vulnerabilities become common in the ecosystem, when periodic reviews reveal out-of-date mitigations, or when customers or prospects express confusion or concern. The practical heuristic is to update at least annually and when major changes or feedback indicate. This lifecycle view places PTMs inside ongoing engineering governance rather than treating publication as a one-time disclosure act (Kohnfelder et al., 11 Nov 2025).
4. Methodological foundations in privacy-centered PTM
A major strand of PTM research is privacy threat modeling. The extended Cloud Privacy Threat Modeling methodology was developed through Method Engineering, specifically the extension-based approach, to support privacy-preserving cloud software development from requirements engineering to design. The target characteristics are Privacy Legislation Support, Technical Deployment and Service Models, Customer Needs, Usability, and Traceability. The method is integrated with the SDLC and proceeds through five steps: Privacy Regulatory Compliance, Cloud Environment Specification, Privacy Threat Identification, Risk Evaluation, and Threat Mitigation. Privacy requirements are labeled as , threats are labeled as , and risk evaluation prioritizes by likelihood (“Importance”) and impact (“Effect”) on a Low, Moderate, or High scale. Threats and countermeasures are systematically linked to original privacy requirements for lifecycle traceability (Gholami et al., 2016).
The implementation-oriented follow-up presents the same structure with a proof-of-concept case study on BiobankCloud, a PaaS for genomic data. In that case study, eight fundamental privacy principles were identified, 26 threat scenarios were mapped to privacy requirements and actors, and a risk evaluation matrix prioritized items such as “Weak Authentication” and “Excessive ToS.” Countermeasures were then mapped back to threats as , reinforcing the methodology’s traceable linkage from legal requirement to technical mitigation (Gholami et al., 2016).
A complementary theoretical line argues that PTM should incorporate causal and counterfactual reasoning rather than rely only on associative thinking. Causal reasoning is defined in terms of direct relationships from variables to outcomes , while counterfactual reasoning considers alternative variables and “what if” scenarios. The proposed quantitative form is
In PTM, this is used to distinguish correlation from causation, support root-cause analysis, and anticipate unseen or hypothetical threats. The paper’s explicit conclusion is that the future of PTM relies on how cybersecurity threats and incidents can be causally and counterfactually imagined (Naidu et al., 2022).
Other privacy-centered variants broaden scope beyond software. Target Privacy Threat Modeling for COVID-19 Exposure Notification Systems addresses software, hardware, humans, and regulations together and defines privacy principles, privacy threats, attacker capabilities, and mitigation strategies for ENS. The model includes surveillance, stored data compromise, misattribution, secondary use, exclusion, linkability, identification, detection, non-repudiation, and integrity compromise, and it emphasizes attacker capabilities such as coercion attacks, data disclosure, eavesdropping, replay attacks, spoofing, and tampering (Gangavarapu et al., 2020).
For IoT, PTMF combines selected tactics from MITRE ATT&CK with techniques from LINDDUN to produce a privacy-centered framework with five sequential phases: Threat Actor, Threat Surface, Threat Entry Point, Threat Propagation, and Threat Result. An expert-driven study recruited 20 privacy and security experts, used a questionnaire of 931 questions, and analyzed 12 IoT privacy threats including Identification of IoT User, Device Identification, Profiling, Data Leakage, Impersonation, and Jurisdiction Risk. The reported contribution is actor-aware and intention-aware privacy threat propagation analysis rather than only likelihood-oriented threat listing (Alalade et al., 24 Oct 2025).
5. Participatory and human-centered PTM
Participatory Threat Modeling extends PTM into situated lived experience. In workshops with Chinese young women living alone, six virtual PTM sessions with 33 participants were conducted online via Microsoft Teams, averaging about 99 minutes per session. The analysis used reflexive and inductive thematic analysis in Mandarin, with iterative open coding by three native Mandarin-speaking researchers. The resulting human-centered threat model is grounded in Usman and Zappala’s framework of context, threats, protective strategies, and reflection, and is integrated with Communication Privacy Management theory (He et al., 9 Feb 2026).
The resulting threat model centers on a “guardianship gap,” meaning the absence of socially expected co-residents or protectors, and describes three mutually reinforcing categories of PSS risk: digitally facilitated physical violence, digital harassment and scams, and pervasive surveillance by individuals, companies, and the state. The cited examples include gig economy platforms exposing addresses and routines, deepfake scams targeting parents through filial piety, hidden cameras in public or shared spaces, smart home vendor backdoor access, and omnipresent CCTV and biometrics that are experienced as both protective and oppressive (He et al., 9 Feb 2026).
The workshops also identified four mitigation strategies: smart home device configurations, boundary management, sociocultural practices, and social media tactics. Each strategy is explicitly described as double-edged. Security cameras, smart locks, and video doorbells may provide perceived control and evidence, but they also create landlord, maintenance, platform, cloud, and parental surveillance risks. Boundary management practices such as performing masculinity may deter opportunistic actors but impose emotional burden and reinforce patriarchal norms. Social media tactics can provide peer support and safety intelligence while also amplifying anxiety loops, misinformation, and gendered harassment (He et al., 9 Feb 2026).
A digital PSS guidebook was developed and iteratively reviewed by participants. Its seven sections cover Physical Threat Prevention, Digital Security Measures, Hidden Camera Detection, Building Mental Resilience, Social Media Management, Reporting / Legal Rights, and a “36 Stratagems” section adapting traditional Chinese strategic wisdom to modern safety. The design, policy, and educational recommendations include scenario-based “home alone” safety modes for smart home devices, local user-owned storage modes, concise privacy summaries, user control over recommendation algorithms, stronger penalties for digital and physical gender-based violence, community-based threat modeling, and curriculum-level digital literacy interventions (He et al., 9 Feb 2026).
6. Evaluation, detection, and benchmarking
Publicly reusable PTM artifacts increasingly take the form of benchmarks and staged evaluation frameworks. ThreatCore is a publicly available benchmark for fine-grained threat detection in NLP that defines a threat as “a statement or phrase intended to announce harm, injury, or punishment to a target, primarily serving to intimidate or coerce the target into performing or refraining from a specific action.” It separates Explicit Threat, Implicit Threat, and Non-Threat, aggregates multiple public datasets, re-annotates them under a unified operational definition, augments rare implicit threats with 2,000 explicit and 4,073 implicit synthetic threats, and produces a benchmark of 21,764 total instances. The principal global metric is Macro-F1,
and the paper reports that implicit threats remain substantially harder to detect than explicit ones. Semantic Role Labeling is used as an intermediate representation extracting Actor, Action, and Victim, with Phi4:14b plus SRL achieving the best macro-F1 of 0.773 (Bruni et al., 11 May 2026).
A narrower online moderation study defines a public threat as “advance notices that perpetrators upload before committing terror in public places.” It collected 500 non-threat post titles from a Korean online community and 20 threat titles from verified public threat content, then evaluated GPT-3.5, GPT-4, and PaLM under a constrained “threat” versus “safe” prompting setup. Statistical analysis found strong accuracy for all models, with GPT-4 reported at 97.9% non-threat and 100% threat accuracy, while PaLM was described as highly cost-efficient in API pricing (Kwon et al., 2023).
An additional evaluation framework addresses novel CBRN threat disclosure by foundation models. Using mirror-image E. coli as a test case, the study proposes a four-stage progression: Stage 1, cannot reason about the threat even with expert prompting; Stage 2, may disclose under threat-aware expert guidance; Stage 3, may disclose to naive experts; Stage 4, may disclose to an unskilled individual. In a small controlled study with 12 graduate-trained biologists lacking prior knowledge of mirror-life implications, Sonnet 3.5 plus web search produced an average score of 28.5/100, web search alone 43.5/100, and a public web baseline scored 36/100. Under threat-aware expert prompting, Sonnet scored 80.2/100 while Haiku scored 5/100. The proposed significance for PTM is early warning: red-teaming newly trained models on unpublished threats may detect Stage 2 or Stage 3 capabilities before broader disclosure becomes possible (Esvelt, 19 Mar 2025).
7. Public knowledge bases, AI supply chains, and automated PTM
A further extension of PTM appears in public knowledge infrastructures. Public enumerations such as CVE, CWE, CPE, CAPEC, and MITRE ATT&CK are described as the backbone of cyber threat and vulnerability identification. They support asset identification, vulnerability cataloging, weakness taxonomies, attack-pattern taxonomies, and tactic-technique-procedure modeling, but the literature emphasizes major interoperability problems: incomplete mappings, ambiguity, many-to-many relationships, textual fields that impede automation, and incomplete chaining from asset to vulnerability to threat pattern. The paper also reports that network monitoring data is relevant to 131 of 707 ATT&CK techniques, covering 13 out of 14 tactics, which suggests that public enumerations enable broad but incomplete threat modeling from observable infrastructure data (Sadlek et al., 2022).
In adversarial machine learning, a “public” threat formulation is made explicit in Transfer Attacks using Public Models. The attacker is assumed to have white-box access to all publicly available models trained for the same task, but not to the defended target, and cannot train new surrogates or query the target. Formally, with public source models and attack algorithms , the adversary constructs 0 subject to 1. PubDef is evaluated against 24 public models and 11 attack algorithms; on ImageNet it achieves 62% accuracy under the strongest transfer attack versus 36% for the best adversarially trained model, while clean accuracy is 78% versus 80% for an undefended model (Sitawarin et al., 2023).
AI supply chains create additional PTM surfaces. MalHug performs threat analysis on a mirrored Hugging Face instance and, over more than three months, monitored 705,991 models and 176,386 datasets, identifying 91 malicious models and 9 malicious dataset loading scripts. The reported malicious behaviors include reverse shell, browser credential theft, and system reconnaissance. Its architecture combines dataset loading script extraction, model deserialization, in-depth taint analysis, and heuristic pattern matching, illustrating how PTM in model hubs increasingly requires semantic-level rather than signature-only analysis (Zhao et al., 2024).
The risk is not only in hubs but in the pre-trained artifacts themselves. Neuron-Level Backdoor Attacks demonstrate that pre-trained models are universally vulnerable when an attacker can publish or release poisoned pre-trained parameters. The attack fixes trigger-instance representations to attacker-chosen vectors during pre-training and can produce nearly 100% attack success rate across arbitrary downstream tasks in both NLP and CV, with minimal impact on clean accuracy or F1. Among the evaluated defenses, model pruning is reported as a promising direction because it excludes backdoored neurons (Zhang et al., 2021).
Automation-oriented PTM is also emerging in domain applications. ThreatGPT is an agentic AI assistant for public safety systems that accepts free-form system descriptions and supports framework-driven analysis using STRIDE, MITRE ATT&CK, CVE reports, NIST, and CISA. Its architecture includes a CLI layer, AI agent layer, knowledge base or training dataset layer, and a pretrained LLM layer using Gemini. The system is described as trained with 50+ detailed threat model examples, supports simple, compound, and complex prompt types, and generates outputs structured as Assets, Entry Points, Attacker Models, Threats/Vulnerabilities, and Mitigation Strategies. The reported runtime is about 30 seconds compared with 40+ hours for manual efforts (Zisad et al., 4 Sep 2025).
Taken together, these developments indicate that PTM now spans public disclosure, privacy engineering, human-centered safety analysis, benchmark construction, public knowledge-base integration, and AI-driven automation. The common thread is not a single notation or sector, but the insistence that threat assumptions, threat traces, and mitigations be structured enough to be reviewed, compared, updated, and acted upon across organizational and technical boundaries.