Threat Modeling · Prioritisation

DREAD

A scoring scheme for the question STRIDE leaves open: which threat do we fix first? DREAD rates every threat across five factors and turns a long list into a ranked queue — so finite engineering effort lands on the risks that matter most.

What it is

DREAD is a risk-prioritisation model, not a discovery method. You use STRIDE (or PASTA, or a pentest) to find threats, then DREAD to rank them. Each threat is scored on five factors; the scores combine into a single rating that drives the fix order. It's simple and fast — its strength and its limit. Because scoring can be subjective, we apply it with explicit, written criteria so two assessors reach comparable numbers.

The five factors

DDamageHow bad is the impact if the threat is realised? Data loss, financial harm, safety, reputation.

RReproducibilityHow reliably can the attack be repeated? Always, or only under rare conditions?

EExploitabilityHow much skill, access or effort does the attack require? Script-kiddie or nation-state?

AAffected usersHow many users or systems are hit? A single account, or the whole tenant?

DDiscoverabilityHow easily can an attacker find the weakness? Obvious, or deeply hidden?

How it works — the scoring

Each factor is rated on a small scale — most teams use 0–10, or a simpler High / Medium / Low. The five scores are summed (or averaged) into a total that buckets the threat into a priority band. The exact numbers matter less than consistency: the value is a defensible ordering, not false precision.

High — fix now Medium — plan a fix Low — accept or monitor

A note on Discoverability. Many teams drop or down-weight this factor — "security through obscurity" shouldn't lower a threat's priority. We typically score it but never let a low discoverability mask a high-damage, easily-exploited issue.

How we audit your systems with DREAD

We score against written criteria — each factor has explicit anchors so ratings are repeatable, not gut feel.
We validate before we rank — reproducibility and exploitability are confirmed on the live system, not assumed.
We blend it with impact-based risk — DREAD for speed, a business-impact lens (PASTA-style) where the stakes are high.
You get a ranked register — every threat with its five scores, total, band and recommended action.

How we implement it

DREAD is the prioritisation layer in our engagements: STRIDE (or a red-team) surfaces the threats, DREAD orders them, and the ranking drives the remediation roadmap your team works through. For AI systems we feed in the same data our adversarial engine produces — confirmed exploitability and affected-user counts from real attack runs — so the scores reflect what actually breaks, mapped to OWASP, the EU AI Act and NIST.

DREAD is a published risk-rating scheme. Scoring is inherently judgement-based; we mitigate that with explicit criteria. General guidance, not legal advice.

Turn a threat list into a fix roadmap.

📞 Book a session ← Discover with STRIDE ▶ Run a live scan