Brett Crawley November 5, 2026 Threat Taxonomy

A Threat Taxonomy for Critical Infrastructure (Cyberwarfare)

One Console, a Thousand Sites: A Threat Taxonomy for Critical Infrastructure (Cyberwarfare) TL;DR In my launch post for Black Start I wrote about the night in October 2026 when hundreds of French supermarkets had their refrigeration forced into defrost from a remote console, and about the second wave across seven…

Continue reading

One Console, a Thousand Sites: the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, 17 suits, 10 structural hazards, 231 threats

Recently Published

Black Start, a threat modeling card game for infrastructure under cyberwarfare: 245 cards, two decks, 231 threats

Black Start

A Threat Modeling Game for Infrastructure (Cyberwarfare) TL;DR...

Mapping the taxonomy to STRIDE, CAPEC, CWE, ATT&CK for ICS, CIE and the standards: 231 threats, 67 ICS techniques, 69 CWEs and 65 CAPEC patterns, shown on a Black Start control panel with operator screens, a drone over a fenced site and a strip of severity lamps

Mapping the Critical Infrastructure Threat Taxonomy

Mapping the Critical Infrastructure Threat Taxonomy: STRIDE, CAPEC,...

ritical Condition: three cards from the game fanned over a dark radiograph background, with the title and "245 cards, two decks, 231 threats".

Critical Condition

A Threat Modeling Card Game for Hospitals and...

Mapping coverage by suit: for each of the 17 suits and the structural hazards, how many entries map to CAPEC, CWE, ATT&CK, EMB3D, MDS2 and LINDDUN.

Mapping the Hospital and Medical Device Threat Taxonomy

Mapping the Hospital and Medical Device Threat Taxonomy...

Elevation of Care: a threat modeling card game for the systems that watch over someone at home. A name badge and a nurse's fob watch on a striped tunic, above a fan of five game cards.

Elevation of Care

Elevation of Care: Threat Modeling the Systems That...

Mapping the Care Assistant Threat Taxonomy to STRIDE, LINDDUN, CAPEC and CWE. A panel of the headline numbers for 74 entries: STRIDE 25 clean, LINDDUN 20 clean, CAPEC 8 direct, CWE 12 direct, and 35 missed by all four.

Mapping the Care Assistant Threat Taxonomy

Mapping the Care Assistant Threat Taxonomy to STRIDE,...

Mapping the AI and Agentic Systems Threat Taxonomy: the Elevation of Autonomy cards over a neon grid.

Mapping the AI and Agentic Systems Threat Taxonomy

Mapping the AI and Agentic Systems Threat Taxonomy...

pen House header: the words Open House over a thermal-image cross-section of a connected house, with every device glowing as a heat signature and links to a cloud, a phone and a laptop.

Open House

Open House: A Threat Modeling Card Game for...

Header reading Mapping the Smart Home Threat Taxonomy: 169 threats and 10 structural hazards, checked against MITRE; 27 threats match no CAPEC pattern or CWE. Below is a thermal cross-section of a house.

Mapping the Smart Home Threat Taxonomy

Mapping the Smart Home Threat Taxonomy to STRIDE,...

Elevation of Email Flow, a threat modeling card game for email infrastructure. Five cards from the deck fanned on an airmail envelope: Ingress Bypass, DKIM Replay, SMTP Smuggling, Scanner Prompt Injection and Envelope and Header Duality.

Elevation of Email Flow Launch

Threat modeling the machinery that delivers email TL;DR:...

Software Factory: threat modeling the machinery that builds your software. A fan of five cards on brushed steel between hazard stripes.

Software Factory - Threat Modeling the Machinery That Builds Your Software

TL;DR: Software Factory is a new trick-taking threat...

Mapping the Software Factory Threat Taxonomy: STRIDE, CAPEC and CWE for all 231 threats. Seven real entries from the mapping linked to their STRIDE letter, CAPEC 3.9 pattern and CWE 4.20 weakness; two, Stale VEX and Policy Drift, have no CAPEC pattern but do have a CWE weakness.

Mapping the Software Factory Threat Taxonomy

Mapping the Software Factory Threat Taxonomy to STRIDE,...

Mapping the Email Threat Taxonomy: STRIDE, CAPEC and CWE for all 125 threats. Seven real entries from the mapping linked to their STRIDE letter, CAPEC 3.9 pattern and CWE 4.20 weakness: MX Redirection has a CAPEC pattern but no weakness, Scanner Prompt Injection a weakness but no pattern, and Remediation Race neither.

Mapping the Email Threat Taxonomy

TL;DR In The Unmodeled Attack Surface I made...

Games with Purpose

51 Card and Board Games for Security, Privacy...

The Threat Model Was Never the Point: What AI Threat Modelling Does and Doesn't Do

AI Assisted Threat Modeling

The Threat Model Was Never the Point: What...

A hedgehog's front foot poking out from under the hay inside its house.

A Night in the Life of Our Hedgehog (Caught on Wildlife Cam)

This is what some of you have been...

See more articles

Browse all Topics