Threat Mitigation Mapping
FreeConnect threats to controls for effective security planning.
Free · Opens the source repo
What Threat Mitigation Mapping does
The Threat Mitigation Mapping skill is designed to help security professionals systematically connect identified threats to appropriate security controls and mitigations. This skill is particularly useful when prioritizing security investments, creating remediation plans, or validating the effectiveness of existing controls. By leveraging a structured approach, users can ensure that all potential threats are addressed and that security measures are layered appropriately to provide comprehensive protection.
This skill operates on core concepts such as control categories, which are divided into preventive, detective, and corrective measures. Users can map threats to specific controls across various layers, including network, application, data, endpoint, and process. This structured mapping facilitates a defense-in-depth strategy, ensuring that multiple layers of security are in place to mitigate risks effectively.
Additionally, the skill provides a library of templates and detailed examples for various security planning tasks. Users can access templates for creating mitigation models, scoring defense in depth, drafting executive summaries, and reporting critical gaps. This resource is invaluable for security architects and risk management professionals who need to create thorough and actionable security plans.
Best practices are also outlined within the skill, emphasizing the importance of mapping all threats, layering controls, and regularly reviewing effectiveness. By following these guidelines, users can improve their security posture and ensure that their defenses evolve alongside emerging threats.
When to use it
Use this skill when developing security strategies, validating existing controls, or planning security investments.
When not to use it
This skill may not be suitable for teams looking for automated security solutions or real-time monitoring tools.
What you can build with it
Prioritizing Security Investments
Use this skill to identify and prioritize security investments based on mapped threats and controls.
Creating Remediation Roadmaps
Develop detailed remediation plans that align threats with appropriate security controls using the provided templates.
Validating Control Coverage
Assess the effectiveness of existing security controls by mapping them against identified threats.
How to install Threat Mitigation Mapping
View source1. Install with the skills CLI
npx skills add wshobson/agents/threat-mitigation-mapping --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by wshobsonThreat Mitigation Mapping
Connect threats to controls for effective security planning.
When to Use This Skill
- Prioritizing security investments
- Creating remediation roadmaps
- Validating control coverage
- Designing defense-in-depth
- Security architecture review
- Risk treatment planning
Core Concepts
1. Control Categories
Preventive ────► Stop attacks before they occur
│ (Firewall, Input validation)
│
Detective ─────► Identify attacks in progress
│ (IDS, Log monitoring)
│
Corrective ────► Respond and recover from attacks
(Incident response, Backup restore)
2. Control Layers
| Layer | Examples |
|---|---|
| Network | Firewall, WAF, DDoS protection |
| Application | Input validation, authentication |
| Data | Encryption, access controls |
| Endpoint | EDR, patch management |
| Process | Security training, incident response |
3. Defense in Depth
┌──────────────────────┐
│ Perimeter │ ← Firewall, WAF
│ ┌──────────────┐ │
│ │ Network │ │ ← Segmentation, IDS
│ │ ┌────────┐ │ │
│ │ │ Host │ │ │ ← EDR, Hardening
│ │ │ ┌────┐ │ │ │
│ │ │ │App │ │ │ │ ← Auth, Validation
│ │ │ │Data│ │ │ │ ← Encryption
│ │ │ └────┘ │ │ │
│ │ └────────┘ │ │
│ └──────────────┘ │
└──────────────────────┘
Templates and detailed worked examples
Full template library and detailed mitigation/control mappings live in references/details.md. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.
Best Practices
Do's
- Map all threats - No threat should be unmapped
- Layer controls - Defense in depth is essential
- Mix control types - Preventive, detective, corrective
- Track effectiveness - Measure and improve
- Review regularly - Controls degrade over time
Don'ts
- Don't rely on single controls - Single points of failure
- Don't ignore cost - ROI matters
- Don't skip testing - Untested controls may fail
- Don't set and forget - Continuous improvement
- Don't ignore people/process - Technology alone isn't enough
Frequently asked questions about Threat Mitigation Mapping
Similar skills
Microsoft Threat Modeling Tool Generator
Easily create .tm7 files for threat modeling.
Threat Model Analyst
Perform comprehensive threat modeling and analysis.
Modeling Threats with OpenCTI
Centralize and visualize cyber threat intelligence effectively.
Zero Trust DNS with NextDNS
Secure your DNS queries with encrypted protection and threat blocking.
STIX/TAXII Feed Integration
Integrate STIX/TAXII threat intelligence feeds seamlessly.
Attack Path Analysis with XM Cyber
Identify and prioritize vulnerabilities in your security landscape.