Defines business objectives and critical assets to anchor threat modeling in organizational impact.
This skill implements Stage 1 of the PASTA (Process for Attack Simulation and Threat Analysis) framework, helping security professionals and developers align their technical threat modeling with actual business value. It automatically scans project metadata, configurations, and source code to identify core functions, data sensitivity, and compliance requirements like GDPR, HIPAA, or PCI-DSS. By establishing a clear risk appetite and identifying business-critical assets early, it ensures that subsequent security analysis focuses on the areas of highest organizational impact and regulatory risk.
主要功能
01Generates standardized PASTA Stage 1 Business Context Documents to feed downstream analysis.
02Risk appetite definition based on codebase analysis and project metadata.
03Automated identification of business-critical assets and data sensitivity levels.
04Compliance scanning for regulatory requirements including PCI-DSS, GDPR, and HIPAA.
05Inference of application purpose from API contracts, schemas, and documentation.
066 GitHub stars
使用场景
01Conducting a business impact analysis (BIA) to determine acceptable downtime and data loss thresholds.
02Initiating a formal PASTA threat modeling process for a new or existing application.
03Identifying regulatory compliance requirements early in the software development lifecycle.
