How we’re creating a threat model framework that works for GitLab

What this post added

This post introduces GitLab's adoption and adaptation of the PASTA threat modeling framework. It details the challenges of traditional threat modeling (scalability, late involvement, complexity, lack of enjoyment) and how GitLab's modified framework addresses these by being easy to understand, scalable, and integrated into existing development processes. The core contribution is shifting the execution of threat modeling to project teams using a markdown template, with the security team owning the framework and providing review. This aims to improve security posture and development efficiency.