What are the Threat Modeling Manifesto's five value pairs, and what does valuing one side over the other commit you to?

### Where the document comes from The Threat Modeling Manifesto is a short, freely published statement written in 2020 by a group of threat modeling practitioners who wanted to describe what good threat modeling looks like *without* crowning a single methodology. Its structure is openly borrowed from the Agile Manifesto: a set of `X over Y` value pairs, a handful of principles, then patterns that benefit the practice and anti-patterns that hinder it. That form matters more than it looks. A value pair is not a rule, not a control and not a maturity level. It is a **tie-breaker** for the arguments that actually happen when a practice is under schedule pressure and two good things are competing. ### The five value pairs 1. **A culture of finding and fixing design issues over checkbox compliance.** The point of the exercise is that a design changes. A programme that produces a signed artifact per release and no design changes has satisfied the right-hand item and abandoned the left. 2. **People and collaboration over processes, methodologies, and tools.** Threats are found by people who understand the system talking to each other. Process and tooling carry that conversation; they do not replace it. 3. **A journey of understanding over a security or privacy snapshot.** The model is a shared, growing understanding of the system, not a photograph of it on one date. Note that the Manifesto is explicitly a privacy document as well as a security one. 4. **Doing threat modeling over talking about it.** A rough model that exists beats an elegant programme design that never runs. 5. **Continuous refinement over a single delivery.** One model handed over once is worth less than a model that keeps getting corrected as the system moves. ### What `over` actually commits you to The common misreading is that the right-hand items are condemned. They are not. Compliance evidence is real and often mandatory. A methodology gives you thoroughness and repeatability. Documents are how understanding is recorded, shared with people who were not present, and measured — one of the Manifesto's own principles puts dialog first precisely *while* giving documents that recording-and-measurement job. The claim is narrower and more useful: when the two conflict, the left-hand item wins, and a practice that consistently sacrifices the left for the right is failing even if every artifact exists. That also means the pairs are falsifiable in a way slogans are not. You can look at a team and say which side it is actually buying. ### Using the pairs as a diagnostic Take a fintech that decides its whiteboard sessions are too informal to audit and replaces them with a mandatory forty-page template that each team fills in alone. Pair two has been inverted: a process has replaced collaboration. The Manifesto predicts what follows, and it is what usually follows. Teams optimise for completing the template rather than for finding anything; the sections that are easy to fill get filled; a document arrives that records what the author already believed on the day they started; and because there was no dialog, nobody else in the room ever built the shared understanding that lets a design change happen. The output volume goes *up* while the number of design issues found goes down — which is exactly why counting completed models is such a treacherous metric. The cure implied by the pair is not to throw the template away. It is to put the conversation back at the centre and let the document record its result, which is the smaller half of the same idea. ### How the values relate to the rest of the document The values say what to prefer. The **anti-patterns** name four recognisable ways real practices fail: Hero Threat Modeler, Admiration for the Problem, Tendency to Overfocus and Perfect Representation. The **patterns** name things that help, including taking a systematic approach and assembling varied viewpoints. Read together, the anti-patterns are mostly what it looks like when a value pair has been inverted — a hero practice has lost `people and collaboration`; a session that only admires the problem has lost `finding and fixing`; a team polishing one diagram forever has lost `doing over talking`. ### Interview register Be able to state the five pairs without hedging, then immediately do something with one. The strong answer moves from recall to application in two sentences: name the pair, name a situation you have seen that inverted it, and say what you would trade to put it back. The weak answer recites the list, or worse, treats the Manifesto as a checklist to audit teams against — which converts the whole document into the checkbox compliance its first pair warns about.