Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams

Threat modeling advice often sounds simple until a development team tries to apply it to a real system. Izar Tarandach and Matt Coles join Chris and Robert to discuss their book, Threat Modeling: A Practical Guide for Development Teams, and the collaboration behind it. They explain how the book organizes system modeling, threat discovery, and mitigation into a usable workflow without forcing teams into one methodology. The conversation covers attack trees, LINDDUN, pytm, writing for different experience levels, and the role of empathy when introducing security practices. Their goal is practical: help teams make threat modeling part of software development instead of a specialist exercise performed once and forgotten.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Izar Tarandach and Matt Coles:→ Izar Tarandach on LinkedIn→ Matt Coles on LinkedIn→ Threat Modeling: A Practical Guide for Development TeamsMentioned in this episode:→ Threat Modeling: A Practical Guide for Development Teams→ OWASP pytm→ Attack Trees→ LINDDUN→ Threat Modeling ManifestoFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 A practical guide to threat modeling02:00 How Izar and Matt approach the discipline09:36 Why development teams needed this book11:46 How the collaboration began14:49 Writing practical guidance together21:44 The book’s system-modeling foundation26:03 Four parts of a repeatable workflow29:17 Choosing methods without becoming dogmatic31:38 Attack trees, LINDDUN, and other techniques34:33 Applying the guidance to real teams42:15 Empathy as a threat modeling skill46:01 Using threat modeling beyond security