PASTA
Also known as: Process for Attack Simulation and Threat Analysis
Seven-stage risk-centric threat modeling methodology.
PASTA (Process for Attack Simulation and Threat Analysis) was developed by Tony UcedaVélez and Marco Morana, presented in their 2015 book Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis. PASTA distinguishes itself from STRIDE-style categorical threat modeling by being explicitly risk-centric and process-driven, with seven sequential stages: (1) Define Objectives — establish business and security objectives, regulatory context; (2) Define Technical Scope — identify assets, dependencies, infrastructure; (3) Application Decomposition — analyze application architecture, data flows, trust boundaries; (4) Threat Analysis — identify relevant threats and threat agents; (5) Vulnerability and Weakness Analysis — identify exploitable conditions; (6) Attack Modeling — construct attack trees and scenarios; (7) Risk Analysis and Management — quantify risks and identify countermeasures. The framework's central commitments include: business-objective alignment (security decisions should align with what the business is trying to achieve and protect); attacker-perspective modeling (think like an adversary, not just like a defender); risk quantification (move beyond categorical threat lists to actionable risk decisions); integration with development lifecycle (threat modeling as ongoing practice, not one-time exercise). PASTA is more demanding than STRIDE — the seven-stage process produces more thorough analysis but requires substantial expertise and time. The framework has been adopted in mature security programs particularly in financial services, where its risk-centric framing aligns with broader enterprise risk management. Adoption is narrower than STRIDE's but typically deeper.
Core components
- Seven sequential stages: Define Objectives, Define Technical Scope, Application Decomposition, Threat Analysis, Vulnerability and Weakness Analysis, Attack Modeling, Risk Analysis and Management
- Risk-centric rather than threat-categorical
- Business-objective alignment
- Attacker-perspective modeling (attack trees, scenarios)
- Risk quantification
- Integration with development lifecycle
- Distinction from STRIDE (process methodology vs categorization)
- More demanding than STRIDE — substantial expertise and time required
Primary use case
Risk-centric threat modeling in mature security programs; foundation for substantial threat-modeling practice in financial services and regulated industries; basis for some enterprise threat-modeling certifications; integration with broader enterprise risk management; reference framework in advanced threat-modeling education; complement to STRIDE in organizations needing more thorough risk-centric analysis; foundation for some commercial threat-modeling consulting practices.
Common criticisms
- Substantially more demanding than STRIDE — the seven-stage process can take weeks or months for a single application, limiting scalability across application portfolios
- requires substantial expertise that not all security teams have
- integration with agile and DevSecOps practices is genuinely difficult — full PASTA cycle doesn't fit sprint cadences
- commercial PASTA training and consulting industry has produced compliance-style adoption with varying analytical fidelity
- less widely adopted than STRIDE, with smaller community of practitioners and less tooling support
- cross-walking with STRIDE-based threat models requires substantial interpretive work
- the framework's complexity can produce thorough but unactionable threat models
- integration with risk frameworks like FAIR is conceptually compatible but operationally complex
- tendency to produce static threat models that don't keep pace with continuous deployment realities
- the 'risk-centric' framing requires risk-quantification capability that many organizations lack.
Lineage
- Siblings
- STRIDE