What is threat modeling and how does it support risk management?

• A. A structured process to identify threats and apply appropriate security controls.
• B. A method to forecast market threats to a product's launch.
• C. A compliance check for regulatory threats.
• D. A technique to minimize development time.

Answer: (A)

Threat modeling is a structured process to identify threats to a system and determine and implement the right security controls. In risk management, this approach provides a clear, systematic way to list what needs protection, understand how things could go wrong, estimate how likely each threat is and how much impact it would have, and then prioritize mitigations based on that risk. By mapping assets, potential attackers, attack surfaces, and existing weaknesses, threat modeling helps teams select controls that address the most significant risks and track improvements as the system evolves. It also keeps security decisions aligned with business goals and resource constraints, making risk mitigation more proactive and defensible over time.

This isn’t about forecasting market threats to a product’s launch, performing regulatory threat compliance checks, or rushing development—none of those directly target identifying and reducing security risk in a systematic way.