New course: Rapid Threat Modelling for Developers

Most vulnerabilities are not accidents. They are decisions that looked reasonable at the time, made before anyone asked who would attack the feature or where it trusts its input. Threat modelling is how you ask those questions early, and it does not require a security background.

Rapid Threat Modelling for Developers, now on SecDim Learn, teaches a repeatable method you can run on a real feature in under 30 minutes. It starts with the two questions every threat model has to answer: who would target this system and what do they already have, and where are the trust boundaries where input stops being yours to trust. From there STRIDE gives you six categories to check each feature against: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

The course turns that into something you can hold in your head. The SecDim Threat Thinking Matrix puts five actor types against six plain-language threat categories so your coverage is visible at a glance, and two worked strategies show you how to drive it feature-first or attack-first.

It also treats AI as a first-class part of the job, on both sides. You use an LLM to enumerate threats faster, then see exactly where its output falls short without your context: business logic, ownership models, internal service architecture, and timing side channels. Then you build a threat model for an LLM-powered feature itself and work through prompt injection, tool abuse, data leakage, and integrity drift, along with the structural controls that contain them.

In labs, you apply the matrix to a live system and run AI-assisted STRIDE on its payment flow. You put on an attacker’s hat (hacker mindset), exploit sophisticated vulnerabilities in an app, then fix them at the root cause and map each finding back to STRIDE.

Topics covered include:

• Threat actors and attack sources, grounded in real incidents
• Trust boundaries, and where they appear in real systems
• STRIDE, with a before-and-after code example per category
• The SecDim Threat Thinking Matrix for visible, repeatable coverage
• AI-assisted threat enumeration, and the gaps AI leaves without your context
• Modelling and securing LLM-powered features
• Two labs: model a live system, then exploit and fix one yourself

If you want the vulnerabilities gone before they ship, this is where the review starts.

Check it out on SecDim Learn: Learn - SecDim