Threat Modeling Workshops

For teams that want to do more than tick a training box.

Whether you're developing secure software, building AI systems or running a Security Champions programme, our Play to Learn workshops help make security learning practical, collaborative and accessible.

Great for:

Development teams learning threat modelling for the first time.
Security Champions programmes looking for engaging technical activities.
Security teams encouraging more collaborative risk analysis.
Engineering leaders building security awareness into development practices.
Trainers and consultants looking for hands-on cybersecurity learning experiences.

Explore our workshops

Elevation of Privilege
Learn to identify security threats in software systems using the six STRIDE threat categories.
Your team explores a realistic architecture and uses Elevation of Privilege game to find threats and practise collaborative security analysis.
You'll learn to:
- Recognise and apply STRIDE threat categories.
- Identify potential threats within software architectures.
- Develop and discuss realistic threat scenarios.
- Communicate and document security findings.
Perfect for: Developers, software architects, DevSecOps teams and Security Champions.
Explore this experience
Elevation of Machine Learning Security
AI is changing the game. Time to change how we think about threats.
Using Elevation of MLSEC, participants explore AI security threats through the DIMO framework: Dataset, Input, Model & Output risks.
You'll learn to:
- Recognise security threats specific to AI and machine learning.
- Apply DIMO to examine AI/ML system architectures.
- Develop realistic AI threat scenarios.
- Discuss security risks and possible mitigations.
Perfect for: AI engineers, ML developers, security architects, DevSecOps teams and AI Security Champions.
Explore this experience

Flexible delivery - In person

Our in-person sessions combine a short, engaging training exercise, a sample scenario, and a full set of cards ready to go.

You don’t need any prior experience, just curiosity and a willingness to join in. The format is relaxed, practical, and genuinely fun. You’ll explore threats, discuss options, and see how the game helps engineers think more clearly about security.

Or Online

Remote doesn’t mean second best. We’ve developed Croupier to bring the best game experience online. Before the session, each player receives the game deck by post. Then, using Croupier, random hands are dealt to each player, who selects their hand from their own deck, all ready to play when the session begins on zoom.

No clunky interfaces. No screen fatigue. Just players talking, thinking, reacting to the shared system architecture, with real cards in their hands. You can read the room, spot who's ready to contribute, and keep the game flowing naturally.

Explore Croupier

Identifying abuse before designing architecture: Embedding Game-Based Threat Modelling into Agile Delivery at a Major Latin American Bank
This case study is based on the account of Max Alejandro Gómez-Sánchez Vergaray, AppSec & DevSecOps Consultant, who designed and led an application security programme during the digital transformation of...
GEA: Supporting IEC 62443-4-1 development processes with the Elevation of Privilege threat modeling game
As part of its ongoing commitment to secure product development, GEA is aligning its automation teams with IEC 62443-4-1, the standard for secure development lifecycle processes in industrial automation and...
Building autonomous threat modeling within an ISO 27001 ISMS through play at Admincontrol
Admincontrol provides secure software platforms for board management and confidential document collaboration. The company evolved its threat modelling practice by introducing OWASP® Cornucopia. This case study explores how a structured,...
How the EoP game identified threats in a system everyone thought was secure
At LogMeIn, threat modelling had become a regular part of the development process. But some systems could still be difficult to challenge effectively. The problem was not necessarily a lack...
How the Financial Times scaled threat modelling across engineering
Based on the original article, “Threat modelling at the FT”, published by FT Product & Technology on Medium. In this case, the Financial Times described how it embedded structured threat modelling...