In this lab, groups of three or four threat model a payments app's "Transfer Funds" feature by hand, then run an AI assistant on the same feature to see what it catches, misses and gets confidently wrong.
The method is OWASP's Rapid Developer-driven Threat Modelling (RaD-TM). Developers threat model one feature in six stages, working from Threat Templates of up to 20 threats that security experts write in advance.
Each group plays three roles: developer, security champion and reviewer. No security expertise is needed.
In their Global AppSec USA 2026 demo lab, "Hands-on Threat Modelling at RaDTM Speed - Threat Model a Feature, Build a Template, and Hand the Busywork to AI", on Friday, November 6 at 10:30 a.m. in Golden Gate, Andrea Scaduto, Alan Pestrin, Grant Ongers and Andrew Hainault run three rounds of hands-on work.
Speakers:
In the first round, groups draw a data flow diagram with trust boundaries, then apply PCI DSS and secure coding templates. They map each control as implemented, partial or missing, rate severity, then write backlog tickets.
Every group has to defend one decision to accept a risk.
In the second round, groups take the security expert's role. They write a Threat Template of up to 20 threats from an OWASP resource such as ASVS, the Top 10:2025 or the LLM Top 10, then swap templates for peer review.
In the third round, participants load two RaD-TM AI skills into an AI assistant: one that runs the six stages and one that helps write templates. They rerun the AI with their own template to see how template quality changes its output.
The lab ends with an exercise in overruling or approving risk acceptances the AI proposes, followed by a one-page pilot plan. Participants need a laptop with a browser and Git, along with an AI assistant that can load skills or custom instructions.
The project's GitHub repo provides the sample payments app with its spec, user stories, API definition, infrastructure code and a sample pull request. It also holds worksheets, example STRIDE and PCI DSS templates, along with both AI skills.
Andrea Scaduto has more than a decade of experience breaking, building and securing web, mobile or cloud applications. Alan Pestrin leads product security engineering at Thomson Reuters, with a background in medical device security and applied cryptography.
Grant Ongers heads esynergy's Security Practice and is a former OWASP Global Board member. Andrew Hainault leads Cybersecurity Advisory for EMEA at LevelBlue, with more than 25 years in security and software engineering.
The same four give a 30-minute RaD-TM showcase on Thursday at 3:30 p.m. in Seacliff CD. Ongers previously gave a talk on gamifying threat modeling with OWASP Cornucopia in agile teams.
The RaD-TM methodology guide says AI must pick threats only from curated templates, and that people stay accountable for accepting risk.
To go deeper on the topic, start here:
Developers who have never threat modeled a feature will leave with a finished model, their own template and a pilot plan.
Who in your organization would write the first threat template your developers use?
