This threat model template gives you a ready-made table for mapping out what could go wrong before it does: assets worth protecting, the threats against them, how likely each one is, what the impact would be, and what you’re doing to mitigate it. Instead of starting from a blank spreadsheet, make a copy and fill in your own system. Whether you’re threat modeling a new feature or reviewing an existing system, the structure below covers what most threat models need.
What This Threat Model Template Covers
This template is built around the same core questions laid out in the OWASP Threat Modeling Project, condensed into six practical columns you fill in directly: asset, threat, likelihood, impact, risk level, and mitigation. Unlike a document, this template is a table, so you’ll likely end up with more rows than assets you can list in one sitting. That’s normal. Threat modeling works best as a living record you revisit, not a one-time exercise you finish and file away.
This works whether you’re planning a new feature and want to think through what could go wrong before writing code, or reviewing something already built and trying to figure out where the real risk sits. Pair it with our API security checklist or mobile app security checklist if you’re threat modeling something in either of those categories specifically.
📌 How to use this: Click the button above. Google will ask if you’d like to make a copy, click “Make a copy” and it opens directly in your own Google Sheets. Add as many rows as you need, one per asset.
🎯 Asset
What you’re actually trying to protect. This could be a system, a specific type of data, a user flow, or a piece of infrastructure. Be specific here, “the website” is too broad to threat model usefully.
⚡ Threat
What could actually go wrong with that asset. Think in terms of who would want to attack it and how, not just a vague worry. Our breakdown of CVE vs CWE vs CAPEC explains how threats and vulnerabilities are typically categorized.
📊 Likelihood
How realistic this threat actually is given your current setup, rated Low, Medium, or High. This isn’t about worst-case paranoia, it’s about what’s plausible given who would target this asset and how exposed it currently is.
💥 Impact
What happens if the threat succeeds, also rated Low, Medium, or High. A low-likelihood threat with critical impact, like a full database breach, often deserves more attention than a high-likelihood threat with minor impact.
⚠️ Risk Level
The combination of likelihood and impact, which is what actually decides priority. A threat that’s both likely and damaging goes to the top of the list regardless of how technically interesting it is to fix.
🛡️ Mitigation
What you’re doing, or plan to do, to reduce the risk. This should be specific and actionable, not “we’ll be more careful.” If a mitigation touches login flows, our login security checklist is a useful place to check what “specific” actually looks like.
A blank spreadsheet is intimidating precisely because threat modeling feels like it should be exhaustive. It doesn’t need to be. Start with your three or four most obvious assets, work through the columns for each, and expand from there. A short, honest threat model beats a long one that never gets finished.
Pair this with our Security Report Template for writing up what you find, or explore our Secure Development guides for building security in from the start.