STRIDE vs PASTA vs LINDDUN — Complete Threat Modeling Methodology Guide
Compare the world's leading threat modeling frameworks. Learn when to use STRIDE, PASTA, LINDDUN, and MAESTRO for maximum security coverage.
Table of Contents
What is Threat Modeling?
Threat modeling is a structured process for identifying, quantifying, and addressing security threats to a system. By analyzing architecture, data flows, and trust boundaries, teams proactively discover vulnerabilities before attackers do.
The methodology you choose shapes what threats you find. STRIDE excels at systematic security analysis, PASTA adds risk-driven business context, LINDDUN focuses on privacy threats, and MAESTRO addresses AI-specific attack surfaces. Understanding each methodology's strengths is essential for building a threat modeling program that actually covers your attack surface.
STRIDE: Security Threat Classification
STRIDE is a threat modeling methodology developed by Microsoft in 1999. It classifies threats into six categories, each mapped to a violation of a security property. STRIDE is the most widely adopted methodology for application-level threat modeling and is built into Microsoft's Threat Modeling Tool.
Two common approaches exist: STRIDE-per-element applies all six categories to each component in a data-flow diagram, while STRIDE-per-interaction focuses on the data flows between components. Per-interaction typically yields more focused, actionable findings for complex architectures.
Spoofing
Pretending to be someone or something else. Attackers forge credentials, tokens, or identities to gain unauthorized access.
Example: Forging a JWT token to impersonate an admin user.
Tampering
Modifying data or code without authorization. Attackers alter data in transit, at rest, or within application logic.
Example: SQL injection to modify database records.
Repudiation
Claiming you didn't perform an action. Attackers exploit weak logging to deny malicious activity.
Example: Deleting audit logs after unauthorized data access.
Information Disclosure
Exposing data to unauthorized parties. Sensitive information leaks through errors, side channels, or insecure storage.
Example: Stack traces in production revealing internal paths.
Denial of Service
Making a system unavailable. Attackers exhaust resources to prevent legitimate use.
Example: Rate-limit bypass enabling brute-force attacks on login.
Elevation of Privilege
Gaining higher access than authorized. Attackers exploit flaws to escalate from user to admin.
Example: CSRF on admin endpoints to change user roles.
Pros
- • Well-established with extensive documentation
- • Easy to learn for development teams
- • Built-in tooling (Microsoft TMT)
- • Maps directly to security properties
- • Works well with data-flow diagrams
Cons
- • Limited privacy threat coverage
- • No built-in risk quantification
- • Can produce too many low-value findings
- • Requires manual prioritization
- • No AI/ML-specific threat categories
Best for: Web applications, enterprise software, cloud architectures, Microsoft ecosystem teams.
PASTA: Process for Attack Simulation and Threat Analysis
PASTA is a seven-stage, risk-centric threat modeling methodology that bridges technical security analysis with business impact assessment. Unlike STRIDE's category-based approach, PASTA follows a structured process that begins with business objectives and ends with quantified risk and prioritized countermeasures.
PASTA's strength lies in its ability to communicate risk in business terms, making it ideal for organizations that need executive-level reporting and regulatory compliance evidence. The methodology incorporates real-world threat intelligence and attack simulation into its process.
Define Objectives
Identify business objectives, security requirements, and compliance obligations.
Define Technical Scope
Document the application architecture, data flows, and technology stack.
Application Decomposition
Break down the application into components, trust boundaries, and entry points.
Threat Analysis
Research relevant threat intelligence, attack patterns, and known vulnerabilities.
Vulnerability Analysis
Correlate threats with existing vulnerabilities using tools and manual review.
Attack Modeling
Build attack trees and simulate attack scenarios against the architecture.
Risk & Impact Analysis
Quantify risk, prioritize findings by business impact, and recommend mitigations.
Pros
- • Risk quantification with business context
- • Structured seven-stage process
- • Incorporates real threat intelligence
- • Executive-friendly reporting
- • Strong regulatory alignment
Cons
- • Highest complexity of all methodologies
- • Requires significant time and expertise
- • Limited free tooling available
- • Can be overkill for small applications
- • No privacy-specific threat categories
Best for: Risk-focused teams, regulated industries (finance, healthcare), executive reporting, compliance-driven organizations.
LINDDUN: Privacy Threat Modeling
LINDDUN is a privacy-specific threat modeling methodology developed at KU Leuven. While STRIDE focuses on security properties, LINDDUN systematically identifies threats to personal data and privacy. Each category maps to a violation of a privacy property, making it directly applicable to GDPR, CCPA, and other privacy regulations.
LINDDUN is essential for organizations processing personal data, particularly in healthcare, fintech, and any system subject to European privacy regulations. It complements security-focused methodologies by covering threats that STRIDE and PASTA do not address.
Linkability
Ability to link two or more data items to the same individual across contexts.
Identifiability
Ability to identify an individual from a set of data, even pseudonymized data.
Non-repudiation
Inability to deny having performed an action. This becomes a privacy risk when actions should be deniable.
Detectability
Ability to detect whether a data item or action exists, even without accessing the content.
Disclosure of Information
Unauthorized exposure of personal data to entities that should not have access.
Unawareness
Individuals are unaware of how their data is collected, processed, or shared.
Non-compliance
Failure to comply with privacy regulations, policies, or data subject rights.
Pros
- • Only methodology focused on privacy threats
- • Direct alignment with GDPR requirements
- • Covers threats security models miss
- • Academic rigor with practical application
- • Pairs well with STRIDE for full coverage
Cons
- • Limited automated tooling
- • Smaller community than STRIDE
- • Does not cover security threats
- • Requires privacy domain expertise
- • Less known outside European context
Best for: Privacy-sensitive applications, GDPR compliance, health data systems, fintech, data-intensive platforms.
MAESTRO: AI & ML Threat Modeling
As AI systems become critical infrastructure, traditional methodologies like STRIDE and PASTA lack coverage for AI-specific attack surfaces. MAESTRO is a threat modeling methodology designed specifically for AI and machine learning systems, covering unique risks such as prompt injection, model poisoning, training data extraction, and agent manipulation.
MAESTRO provides a structured six-layer analysis covering the full AI stack: from foundation models and fine-tuning pipelines to agent orchestration and MCP (Model Context Protocol) integrations. It aligns with the EU AI Act, NIST AI RMF, and ISO 42001 requirements.
LLM Threats
Prompt injection, jailbreaking, model extraction
Agent Threats
Tool poisoning, context manipulation, privilege escalation
MCP Threats
Server spoofing, tool schema injection, data exfiltration
STRIDE vs PASTA vs LINDDUN vs MAESTRO: Side-by-Side Comparison
Compare the four leading threat modeling methodologies across key dimensions to determine the best fit for your organization.
| Dimension | STRIDE | PASTA | LINDDUN | MAESTRO |
|---|---|---|---|---|
| Focus Area | Security threats | Risk-centric attacks | Privacy threats | AI/ML system threats |
| Origin | Microsoft (1999) | OWASP community (2012) | KU Leuven (2011) | Aristiun (2024) |
| Process Steps | 6 threat categories | 7 structured stages | 7 privacy categories | 6 AI attack layers |
| Best For | Web apps, enterprise software | Regulated industries, risk teams | GDPR, health data, privacy apps | LLMs, AI agents, MCP systems |
| Complexity | Low–Medium | High | Medium | Medium–High |
| Standards Alignment | OWASP, NIST 800-53 | NIST RMF, ISO 27005 | GDPR, ISO 27701 | EU AI Act, NIST AI RMF |
| Automation Support | High (Microsoft TMT) | Medium | Low | High (Aristiun) |
| Privacy Coverage | Limited | Indirect | Full depth | AI-specific privacy |
| AI Coverage | None | None | None | Full depth |
Which Threat Modeling Methodology Should You Use?
Use this decision guide to select the right methodology, or combine them for broader protection.
Security-focused → STRIDE
You're building web applications, APIs, or enterprise software and need systematic identification of security threats like authentication bypass, injection, and privilege escalation.
Risk-focused → PASTA
You need business-context risk quantification, operate in regulated industries, or must produce executive-level threat reports with financial impact estimates.
Privacy-focused → LINDDUN
You process personal data, must comply with GDPR/CCPA, or build healthcare and fintech applications where privacy threats are a primary concern.
AI-focused → MAESTRO
You're deploying LLMs, AI agents, or MCP integrations and need to address prompt injection, model poisoning, and AI-specific attack surfaces.
Best Approach: Combine All with Aristiun
No single methodology covers every threat category. The most effective programs combine STRIDE for security, LINDDUN for privacy, PASTA for risk quantification, and MAESTRO for AI systems. Aristiun's platform automates all four methodologies simultaneously, giving you full visibility across every threat category, without the manual overhead.
How Aristiun Automates All Methodologies
Aristiun's Security Workbench applies STRIDE, PASTA, LINDDUN, and MAESTRO simultaneously during automated threat analysis. Upload an architecture diagram, connect your code repository, or describe your system, and Aristiun identifies threats across all four methodologies, maps findings to 340+ compliance frameworks, and generates prioritized remediation plans. You can also embed this analysis directly into your CI/CD pipeline with threat modeling as code.
Auto-Detection
AI analyzes architecture and identifies threats across all methodologies
Risk Scoring
PASTA-style risk quantification with CVSS scoring and business impact
Privacy Analysis
LINDDUN-based privacy threat identification with GDPR mapping
Compliance Mapping
Threats mapped to 340+ frameworks automatically
Frequently Asked Questions
Common questions about STRIDE, PASTA, LINDDUN, and threat modeling methodologies.
Explore Related Solutions
Automated Threat Modeling
Apply STRIDE, PASTA, LINDDUN, and MAESTRO automatically with AI
Learn moreCode Security
Architecture-aware SAST, DAST, and SCA scanning with remediation playbooks
Learn moreAI Security
Shadow AI discovery and LLM governance for enterprise AI stacks
Learn moreThreat Modeling as Code
Integrate threat analysis directly into your CI/CD pipeline
Learn moreAutomate Every Methodology with Aristiun
Stop choosing between STRIDE, PASTA, and LINDDUN. Apply all four methodologies simultaneously with AI-powered threat modeling. What took weeks now runs in your pipeline.