How we’re creating a threat model framework that works for GitLab

This post introduces GitLab's adaptation of the PASTA threat modeling framework. It details the challenges of traditional threat modeling (late involvement, scalability issues, complexity, lack of enjoyment) and how GitLab's framework addresses these by being simple, scalable, enhancing DevSecOps with minimal overhead, and fitting into existing development processes. The key change is that project teams, rather than solely the security department, run the threat modeling process using a markdown template, with security providing guidance and review.