Threat Modeling Lab: Threat Model and Fix One Real Feature
A half-day expert workshop where a development team threat models one of its own features and leaves with prioritized findings and fixes assigned into the backlog.
Secure Software Development in Practice teaches developers to threat model and fix what they find. This workshop does it on a feature the team is building right now: in a half-day, the team models it, finds the weak points, and turns them into backlog items with owners, guided by a facilitator who does this work in production systems.
The team needs to bring one real feature, with someone who knows how it works. The scoping call picks it and confirms what can be shared. Everything produced stays with the team; the facilitator sees the design, not the code, unless the team chooses otherwise.
Live, with a practitioner facilitator, for one group of up to 20
Exercises adapted to your own cases in a scoping call
An impact report within a week
A certificate is issued to participants who attended and completed the exercise, and recorded on the TechClass platform.
Agenda
Block 1
Opening
Goals, your group's context, and what participants will leave with.
15 min
Block 2
Learn
Threat modeling on a sample feature: how to draw the data flows, where the trust boundaries are, and the fix patterns for the findings that come up most often.
50 min
Block 3
Practice
Threat modeling one of the team's own features, in small groups, with the facilitator challenging the assumptions.
60 min
Block 4
Apply
The prioritized findings, with fixes written as backlog items and assigned to owners.
45 min
Block 5
Close
Summary, commitments and feedback.
15 min
3.5 hours including two breaks: a morning from 9:00 to 12:30 or an afternoon from 13:00 to 16:30, in your time zone. Practice and Apply take more than half of the working time. You leave with a threat model and a fix list for one feature.
Applies this Skills course
The workshop is the live, hands-on application of this course. In a blended program the course is the pre-work; the workshop is where the group puts it to work on its own cases.
A development team, with its product owner or lead
Developers new to security work
A cohort of developers in a continuous learning program, on a sample application
Fee and registration
Quote on request
Price For up to 20 participants, with a fee for each extra participant up to 30. In person adds travel at cost. There are no design fees: adapting the exercises to your cases is part of every workshop.
Per workshop, quoted on inquiry
Pre-work In a blended program the Skills course is the pre-work and its licenses are quoted with the workshop. A standalone workshop uses a short Essentials course, included with every license.
The Skills course, or an Essentials course
Group
Up to 20 per facilitator; 21 to 30 with a second facilitator
How to book
01
Get in touch
Tell us the workshop, the group and whether you want it online or on site. We come back with a proposal: the date and slot, the delivery, the facilitator and the price.
02
Scoping call
Three to four weeks before the day, a 30-minute call about your goals, the group and its own cases. The facilitator adapts the exercises to them.
03
Pre-work and the half-day
Participants are enrolled on TechClass and take the pre-work one to two weeks before. Then the workshop itself: 3.5 hours, a morning or an afternoon in your time zone.
04
Certificates and the impact report
Within a week: certificates for participants who attended and completed the exercise, feedback collected, and a short report of attendance, feedback, what was produced and the agreed next step.
Workshops serve companies and education organizations alike. A cohort in a continuous learning program books the same workshop; the institution stays responsible for its program and any credit.
Threat Modeling Lab: Threat Model and Fix One Real Feature FAQ
Yes. The scoping call before the day brings your own cases into the exercises, and the facilitator adapts them. The topic and the length stay the same. A topic outside the catalog is scoped and quoted separately.
In a blended program, yes: the course is the pre-work and the workshop applies it. For a standalone workshop, participants take a short Essentials course on the same subject one to two weeks before; Essentials courses are included with every TechClass license.
Up to 20 participants with one facilitator, and 21 to 30 with a second facilitator. Above 30 it is no longer a workshop; ask us about a program instead.
Either. Live online for teams anywhere in Europe and the USA, with a producer running the breakout rooms and the tech. In person at your site, in Finland and the Helsinki region first and elsewhere in Europe on request, with travel at cost.
English or Finnish, as you choose. The agenda is the same in both.
Yes. Participants who attended and completed the exercise receive a certificate, recorded on the TechClass platform alongside their other training.
Workshops are priced per workshop for up to 20 participants, with a fee for each extra participant up to 30, and quoted on inquiry. In person adds travel at cost. There are no design fees.
Within a week, an impact report: attendance, feedback, what participants produced, and the agreed next step. It reports only what was measured.