In a STRIDE threat model, how do you find the threats that were left with no control at all?

## Why gaps hide A wrong control is at least visible: someone wrote something, and a reviewer can argue with it. A missing control is invisible, because nothing is there to look at. If the mapping is written as prose - a paragraph per area saying how the design is secured - absence has nowhere to show up, and a threat that nobody could answer simply drops out of the narrative between two sentences. That is the whole reason this pass is structured. Enumerated threats become rows; the mitigation is a column; and the question 'what has nothing?' becomes a filter rather than an act of memory. ## The mechanical sweep Before the session closes, two passes take a few minutes each. **Filter for blanks.** Every enumerated threat must carry an entry. If the cell is empty, that is a finding in its own right - the model's most valuable output, not an embarrassment to be tidied away. **Look at cardinality.** The relationship between threats and controls is many-to-many, and both directions carry signal. One control written against ten rows is sometimes genuine - a single platform-level enforcement really can close ten variants of the same move - but it is just as often a row filled to look covered. Check per row that the attack actually fails with that control assumed. Equally, a threat that needs five controls stacked to be closed is telling you something about how fragile that part of the design is. A third, cheaper heuristic: compare the count of threats enumerated against the count of distinct controls named. A model with forty threats and four controls has usually not done the mapping; it has written a security overview. ## Where gaps actually cluster The sweep tells you a row is empty. Experience tells you which rows to expect to be empty, and this is what separates a mechanical pass from a useful one. **Threats from actors with legitimate access.** This is the biggest one. A genomics research platform runs its mapping pass and finds a control against nearly everything: credentials, session handling, access control on datasets, encryption of stored genomes, protection of the analysis pipeline. Then there is one row - a researcher with approved access to a dataset copies it in bulk to a personal laptop - and nothing is written next to it. Not because it was judged unimportant: because every family the team knows how to reach for has already been applied and none of them fire. Authentication succeeds. Authorization succeeds. The data is decrypted for exactly the person who is allowed to decrypt it. The asset at stake here is trade-secret research value and the personal data of study participants, and the model's usual vocabulary has run out. The honest answers to that row are all partial, and saying so is the point: per-dataset entitlements so approval is granular rather than blanket; de-identified or synthetic extracts for exploratory work so full copies are rarely needed; analysis-in-place workspaces that make bulk export an exceptional operation rather than a normal one; egress volume monitoring as a detective backstop with a defined response; and administrative measures like agreements and training. None of those is a clean stop. Writing all of them down, with their limits, is a genuinely better model than writing nothing. **Threats to properties other than confidentiality.** Teams have a rich vocabulary for keeping secrets and a much thinner one for keeping a service available or keeping records trustworthy. Those rows go blank disproportionately often. **Threats at the far end of a flow.** The parts of the diagram drawn in the least detail produce the threats with the least specific answers, and vague threats attract vague controls or none. ## False coverage looks the same as coverage Worth naming explicitly: a blank cell is often filled at the last minute with the nearest plausible control, precisely so the table looks complete. That produces a row that reads as covered and is not. If a control appears against a threat it has no obvious relationship to, treat it as a suspected gap rather than an entry - the sweep for blanks and the check that a control genuinely answers its threat are two halves of the same pass. ## What happens to a gap An uncovered threat is not a failure of the model; it is the model working. What matters is that it leaves the room as a tracked item - written down, owned by a named person, and re-read at the next iteration - and gets handed to whoever makes the call about what to do with it. A blank that nobody carried forward is the same as a threat never found.