Skip to main content
Before the agent looks for weaknesses in your code, it writes a threat model. The threat model describes how your application works from a security point of view. The agent uses it to decide what to test first and which behaviour is intended, so it reports fewer false alarms. The agent writes a new threat model for each white-box scan. It is created only when source code is attached. See Connect source code.

​
What the threat model contains

1

System model

The main parts of the application and how they talk to each other.
2

Deployment and trust boundaries

How the application is deployed, and the places where data moves from a less trusted zone to a more trusted one. For example, from the public internet to your API, or from a normal user to an admin.
3

Entry points

The routes, APIs, jobs, and other places where outside input enters the application.
4

Crown jewels and invariants

The most valuable data and actions, and the security rules that must always be true. For example, “a user can only read invoices from their own tenant”.
5

Security decisions

Where the code checks login, permissions, tenants, and input.
6

Documented behaviour and accepted risks

Behaviour that looks risky but is intended, based on your code and documentation. The agent does not report these as findings.
7

Known vulnerability patterns

Patterns in the code that have caused problems before or are likely to cause problems.
8

Sensitive areas, exclusions, and open questions

The parts of the code that need extra care, the parts that are out of scope, and the questions the agent could not answer from the code alone.
The threat model can include diagrams. They are shown as images in the tab.

​
How the agent uses it

  • During the source review, every step of the review gets the threat model. This helps the agent focus on real security boundaries and ignore intended behaviour.
  • During the live pentest, the agent gets a short version of the threat model. It uses it to choose which endpoints and roles to test first.
  • When a later scan has no new source code, the agent can reuse the threat model from an earlier scan. It is marked as earlier context, not as new analysis.

​
View the threat model

1

Open the application

Go to Applications and open the application.
2

Open the Threat model tab

Click the Threat model tab.
3

Pick a scan

Use the Scan menu in the top right to choose a scan. By default, the tab shows the newest scan that has a threat model. During a running scan, the threat model appears as soon as the agent writes it.
If the tab says “A threat model from source analysis will appear here after a pentest runs”, no white-box scan has run yet. If it says “No threat model was recorded for this scan”, the selected scan had no source code, or it was a retest. The threat model is read-only. To correct something the agent got wrong, add the correct information to the scope notes or the application context, or upload a document in Supporting files. The next scan uses it.
The Threat model tab is not turned on for every organization yet. If you do not see it, contact us.