What is the Threat Mitigation Mapping skill?

It is a specialized capability for Claude Code that helps developers and security engineers systematically link identified threats to technical and process-based security controls.

How is the mitigation coverage score calculated?

The score is derived from the implementation status of a control (from 'not implemented' to 'verified') multiplied by its inherent effectiveness rating.

How does it help with defense-in-depth?

The skill analyzes your control set to ensure threats are addressed at multiple layers (e.g., Network, App, Data) and via different control types (Preventive, Detective, Corrective).

Can I use this for compliance reporting?

Yes, the skill includes templates with references to common standards like PCI-DSS, GDPR, and NIST, making it easier to map technical controls to regulatory requirements.

Does it support custom security controls?

Yes, the provided Python templates allow you to define and integrate custom controls specific to your organization's unique technology stack and risk profile.

Threat Mitigation Mapping

Name: Threat Mitigation Mapping
Author: wshobson

bywshobson

•

23,194

•

安全与测试

Maps identified security threats to specific technical controls and mitigations to automate risk treatment and defense-in-depth planning.

The Threat Mitigation Mapping skill empowers Claude Code to act as a security architect by systematically connecting potential threats to appropriate security controls. It utilizes a structured framework to categorize controls as preventive, detective, or corrective across multiple layers including network, application, and data. By providing automated calculation of coverage scores and identifying gaps in defense-in-depth strategies, this skill helps teams prioritize security investments and create robust remediation roadmaps based on industry standards like PCI-DSS and NIST.

主要功能

01Calculation of mitigation coverage and residual risk scores

02Automated mapping of threats to multi-layered security controls

03Gap analysis for defense-in-depth and control diversity

04Built-in library of standard controls including MFA, WAF, and encryption

0523,194 GitHub stars

06Generation of structured security remediation and investment plans

使用场景

01Mapping technical implementations to compliance requirements like PCI-DSS and SOC2

02Designing and validating defense-in-depth architectures for cloud applications

03Prioritizing security engineering tasks based on threat impact and risk scores

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add wshobson/agents threat-mitigation-mapping

For use in Claude.ai and ChatGPT

Download Skill