[{"data":1,"prerenderedAt":1090},["ShallowReactive",2],{"page-\u002Fthreat-report\u002Fgetting-started":3,"navigation":773},{"id":4,"title":5,"body":6,"description":760,"extension":761,"meta":762,"navigation":768,"path":769,"seo":770,"stem":771,"__hash__":772},"docs\u002F04.threat-report\u002F01.getting-started.md","Getting Started with the Threat Report",{"type":7,"value":8,"toc":746},"minimark",[9,13,26,29,34,41,44,72,86,88,92,95,157,172,174,178,191,258,301,316,332,337,361,363,367,370,373,439,454,470,484,486,490,497,518,524,535,547,563,586,588,592,595,645,655,665,676,687,689,693],[10,11,5],"h1",{"id":12},"getting-started-with-the-threat-report",[14,15,16,17,21,22,25],"p",{},"The ",[18,19,20],"strong",{},"Threat Report"," is a read-only, point-in-time view of the residual risk in one of your threat models. You generate it from a model's ",[18,23,24],{},"Analyses"," dialog, read it across a handful of tabs, drill into any element, and export it as a JSON file or a printable HTML page you can save as a PDF. This guide walks you through that first run end to end — from creating the report to sharing it.",[27,28],"hr",{},[30,31,33],"h2",{"id":32},"what-the-threat-report-is","What the Threat Report Is",[14,35,36,37,40],{},"Think of the Threat Report as a snapshot of where your model stands right now: which findings are still open, which have been reviewed, where your MITRE ATT&CK coverage is, which crown jewels are reachable, and where flows cross your security boundaries. It is a ",[18,38,39],{},"reporting"," view, not an analysis engine — it reads your existing model and presents it. It never changes the model, and it never invents findings.",[14,42,43],{},"Use it when you want to:",[45,46,47,54,60,66],"ul",{},[48,49,50,53],"li",{},[18,51,52],{},"Review residual risk"," across an entire model in one place, instead of clicking element by element on the canvas.",[48,55,56,59],{},[18,57,58],{},"Brief a stakeholder"," with a single self-contained page.",[48,61,62,65],{},[18,63,64],{},"Track a point in time"," — a snapshot you can compare against a later one as the model evolves.",[48,67,68,71],{},[18,69,70],{},"Filter and drill"," from a high-level roll-up down to a single component's findings.",[73,74,75],"blockquote",{},[14,76,77,80,81,85],{},[18,78,79],{},"It is a snapshot, not a live scan."," The report describes the ",[82,83,84],"em",{},"modeled"," posture as of the moment you generate it — not a deployed-state scan. Findings are not collapsed into a single risk score, and no coverage percentage is implied. Those same honest caveats travel with every export.",[27,87],{},[30,89,91],{"id":90},"prerequisites","Prerequisites",[14,93,94],{},"Before you can generate a useful report, you need:",[96,97,103],"div",{"className":98,"tabIndex":100,"role":101,"ariaLabel":102},[99],"table-frame",0,"region","Table: Prerequisites",[104,105,106,119],"table",{},[107,108,109],"thead",{},[110,111,112,116],"tr",{},[113,114,115],"th",{},"Prerequisite",[113,117,118],{},"Why",[120,121,122,133,143],"tbody",{},[110,123,124,130],{},[125,126,127],"td",{},[18,128,129],{},"A threat model with elements",[125,131,132],{},"The report reads your components, data flows, security boundaries, and data. An empty model produces an empty report.",[110,134,135,140],{},[125,136,137],{},[18,138,139],{},"Permission to run an analysis",[125,141,142],{},"Creating and running the report is part of the platform's normal analysis workflow. Viewing is read-only.",[110,144,145,150],{},[125,146,147],{},[18,148,149],{},"The Coverage Tools module (optional)",[125,151,152,153,156],{},"Powers the ",[18,154,155],{},"Coverage & Gaps"," tab (MITRE ATT&CK coverage). Without it, the report works exactly as described — the coverage tab simply doesn't show coverage data; nothing else is affected.",[73,158,162],{"className":159},[160,161],"callout","callout-tip",[14,163,164,167,168,171],{},[18,165,166],{},"Tip:"," To get the most from the ",[18,169,170],{},"Reachability"," tab, mark your most valuable components as crown jewels in the model. The report assesses reachability against those; if none are marked, the tab tells you so rather than guessing.",[27,173],{},[30,175,177],{"id":176},"creating-and-running-the-report","Creating and Running the Report",[14,179,180,181,183,184,186,187,190],{},"The Threat Report appears as an analysis class named ",[18,182,20],{}," in any model's ",[18,185,24],{}," dialog. Creating it follows the same flow as any other analysis, with one extra step: you ",[18,188,189],{},"run"," it to compute the snapshot.",[192,193,194,200,214,235,244],"ol",{},[48,195,196,199],{},[18,197,198],{},"Open your model."," Click the model in the Browser to open it in the Data Flow Editor.",[48,201,202,205,206,208,209,213],{},[18,203,204],{},"Open the Analyses dialog."," On the canvas rail down the left of the editor, click the ",[18,207,24],{}," button (the sparkle icon). A dialog titled ",[210,211,212],"code",{},"Analysis: \u003Cyour model's name>"," opens, listing this model's analyses.",[48,215,216,219,220,223,224,226,227,230,231,234],{},[18,217,218],{},"Create the report."," From the ",[18,221,222],{},"New Analysis"," menu, choose ",[18,225,20],{},". A row appears in the analyses table with the status ",[18,228,229],{},"Ready"," and a single ",[18,232,233],{},"Run"," button. That row is a standing report instance attached to your model — it holds no snapshot yet.",[48,236,237,240,241,243],{},[18,238,239],{},"Generate the snapshot."," Click ",[18,242,233],{},". The button shows a spinner while the report reads your model and stores a point-in-time snapshot.",[48,245,246,249,250,253,254,257],{},[18,247,248],{},"Open the report."," The table refreshes every few seconds; when the snapshot lands the row's status turns ",[18,251,252],{},"Done"," and its button becomes ",[18,255,256],{},"View results",". Click it to open the report.",[73,259,260],{},[14,261,262,265,266,268,269,271,272,268,275,271,278,268,281,271,284,268,286,271,288,268,291,294,295,297,298,300],{},[18,263,264],{},"One action per row, chosen by state."," An analysis row offers exactly one forward action, and which one you get is decided by the row's status: ",[18,267,229],{}," → ",[18,270,233],{},", ",[18,273,274],{},"Working",[18,276,277],{},"View progress",[18,279,280],{},"Paused",[18,282,283],{},"Answer",[18,285,252],{},[18,287,256],{},[18,289,290],{},"Failed",[18,292,293],{},"Retry",". There is no separate \"open results\" action on a report that has never been run — ",[18,296,233],{}," is how you generate the first snapshot, and ",[18,299,256],{}," only appears once a snapshot exists.",[14,302,303,304,307,308,311,312,315],{},"When the report opens, the banner reads ",[210,305,306],{},"Reflects the model as of \u003Cdate and time>"," with a green ",[18,309,310],{},"Fresh"," marker, and a summary line such as ",[210,313,314],{},"12 components · 4 boundaries"," sits above the tabs. That's your confirmation the report generated successfully.",[73,317,320],{"className":318},[160,319],"callout-note",[14,321,322,325,326,328,329,331],{},[18,323,324],{},"Note:"," Generating reads the model but never modifies it. If generation fails, any previous snapshot is left untouched: the row goes to ",[18,327,290],{}," (hover its status chip for the reason) and offers ",[18,330,293],{},".",[333,334,336],"h3",{"id":335},"if-you-open-a-report-that-was-never-generated","If you open a report that was never generated",[14,338,339,340,343,344,347,348,351,352,354,355,357,358,360],{},"Opening a report by a path that doesn't go through the analyses table — a bookmarked or shared link straight to the results page, for example — can land you on a report whose snapshot has never been generated. There the report shows ",[210,341,342],{},"No snapshot has been generated for this report yet.",", the banner reads ",[210,345,346],{},"No snapshot has been generated yet.",", and its button reads ",[18,349,350],{},"Generate",". Click ",[18,353,350],{}," to compute the first snapshot without going back to the analyses table. Following the steps above, you'll never see this state: ",[18,356,233],{}," generates the snapshot before ",[18,359,256],{}," ever appears.",[27,362],{},[30,364,366],{"id":365},"reading-the-report","Reading the Report",[14,368,369],{},"The report renders entirely over the stored snapshot, so every tab is mutually consistent — they all describe the same model, as of the same moment. You move between tabs with the segmented control at the top; clicking a tab is a plain view switch and never reloads the page.",[14,371,372],{},"There are five tabs, plus a per-element drill-down:",[96,374,377],{"className":375,"tabIndex":100,"role":101,"ariaLabel":376},[99],"Table: Reading the Report",[104,378,379,389],{},[107,380,381],{},[110,382,383,386],{},[113,384,385],{},"Tab",[113,387,388],{},"What it's for",[120,390,391,401,410,419,429],{},[110,392,393,398],{},[125,394,395],{},[18,396,397],{},"Posture",[125,399,400],{},"The default landing view — a roll-up of the whole model's residual risk, with stats you can click to jump into a filtered view.",[110,402,403,407],{},[125,404,405],{},[18,406,155],{},[125,408,409],{},"Your MITRE ATT&CK coverage and where the gaps are (requires the Coverage Tools module).",[110,411,412,416],{},[125,413,414],{},[18,415,170],{},[125,417,418],{},"Which crown jewels can be reached over modeled flow routes, and what lies on those routes.",[110,420,421,426],{},[125,422,423],{},[18,424,425],{},"Boundary Crossings",[125,427,428],{},"Where flows cross security boundaries, what they carry, and how each crossing reads against your declared-zone data-flow policy.",[110,430,431,436],{},[125,432,433],{},[18,434,435],{},"Residual Risk",[125,437,438],{},"The findings ledger — every finding, open or dispositioned, that you can filter and act on.",[14,440,441,442,445,446,449,450,453],{},"Clicking any element — in any tab — opens its ",[18,443,444],{},"Component Profile"," as an overlay dialog: that element's findings, supporting controls, the data it handles, links to its neighbors, and — for a security boundary — its declared ",[18,447,448],{},"trust zoning"," (zone, planes, domains, and conduits). Close the dialog (press ",[18,451,452],{},"Esc",", click the scrim, or use the close button) and you return to exactly where you were.",[73,455,456],{},[14,457,458,461,462,465,466,469],{},[18,459,460],{},"Banner first."," A scope-and-freshness banner sits above every tab. It surfaces freshness and any completeness flags — for example ",[210,463,464],{},"No security boundaries modeled"," — ",[82,467,468],{},"before"," you read a reassuring count. Read it first; it tells you what the report can and cannot speak to.",[14,471,472,473,477,478,480,481,483],{},"Each tab has a dedicated guide. Start with ",[474,475,366],"a",{"href":476},"\u002Fthreat-report\u002Freading-the-report"," for the shared visual language, the ",[18,479,397],{}," roll-up, and ",[18,482,425],{},"; then move on to the surface that matters for your task.",[27,485],{},[30,487,489],{"id":488},"snapshots-and-freshness","Snapshots and Freshness",[14,491,492,493,496],{},"The report does not query your model live — it reads the snapshot it stored when you generated it. That's deliberate: it keeps every tab consistent with every other. The trade-off is that the report does ",[18,494,495],{},"not"," auto-update. If you edit the model after generating, the report still shows the older snapshot until you regenerate.",[14,498,499,500,502,503,506,507,510,511,514,515,517],{},"The report detects this for you. When the underlying model has changed since the snapshot was taken, the freshness banner switches from green ",[18,501,310],{}," to an amber ",[210,504,505],{},"Stale — the model changed since"," marker, and a ",[210,508,509],{},"Snapshot is stale — Recreate to refresh"," flag appears. The banner's button reads ",[18,512,513],{},"Recreate"," from the moment a snapshot exists (it reads ",[18,516,350],{}," only on a report that has never been run); on a stale report it also picks up a warning accent.",[14,519,520,523],{},[18,521,522],{},"Regenerate when the banner reads stale"," — typically after you:",[45,525,526,529,532],{},[48,527,528],{},"add, remove, or rewire components, flows, boundaries, or data;",[48,530,531],{},"reclassify data sensitivity, change a boundary's declared zoning, or change which element handles which data;",[48,533,534],{},"record a decision on a finding from somewhere other than this report (the canvas, another session).",[14,536,537,538,540,541,543,544,546],{},"To refresh, click ",[18,539,513],{},". The report recomputes a fresh snapshot over the current model and the banner returns to ",[18,542,310],{},". A routine save that changes nothing report-relevant will ",[82,545,495],{}," mark the report stale, so you won't be nagged for no reason.",[14,548,549,550,552,553,556,557,560,561,331],{},"You can also regenerate from the analyses table without opening the report: on a ",[18,551,252],{}," row, open the ",[18,554,555],{},"⋮"," overflow menu and choose ",[18,558,559],{},"Re-run",". It runs the same generation step as ",[18,562,513],{},[73,564,565],{},[14,566,567,574,575,578,579,581,582,331],{},[18,568,569,570,573],{},"Tip — decisions you record ",[82,571,572],{},"inside"," the report behave differently."," They are written to the model like any other, but the report also patches them onto the rows in front of you straight away, so triaging a run of findings doesn't dim the whole page. Instead of flipping to stale, the report shows a note above the tabs — ",[82,576,577],{},"Reflecting N changes made since this snapshot was generated"," — and disables the export buttons until you ",[18,580,513],{},". See ",[474,583,585],{"href":584},"\u002Fthreat-report\u002Fworking-with-findings","Working with Findings",[27,587],{},[30,589,591],{"id":590},"exporting-and-sharing","Exporting and Sharing",[14,593,594],{},"You can export the current snapshot in two formats from the action row at the top of the report:",[96,596,599],{"className":597,"tabIndex":100,"role":101,"ariaLabel":598},[99],"Table: Exporting and Sharing",[104,600,601,614],{},[107,602,603],{},[110,604,605,608,611],{},[113,606,607],{},"Action",[113,609,610],{},"Format",[113,612,613],{},"Use it for",[120,615,616,629],{},[110,617,618,623,626],{},[125,619,620],{},[18,621,622],{},"Export JSON",[125,624,625],{},"Machine-readable JSON",[125,627,628],{},"Feeding the report into other tools, diffing snapshots over time, or archiving the raw data.",[110,630,631,636,639],{},[125,632,633],{},[18,634,635],{},"Export HTML",[125,637,638],{},"Self-contained printable HTML",[125,640,641,642,331],{},"Sharing a readable report. Open the file in any browser and use ",[18,643,644],{},"Print → Save as PDF",[14,646,647,648,650,651,654],{},"Both exports carry the report's substance, not just the ledger: the MITRE coverage facts, the crown-jewel reachability rollup, the ",[18,649,425],{}," data-flow policy (the per-flow declared-zone verdicts, the conduit-error and dead-conduit surfaces), and the residual-risk ledger — each section appears when its inputs are present. The boundary-crossings section keeps the same caveats as the on-screen view: a verdict flags an illegal crossing ",[82,652,653],{},"as drawn"," (declared intent, never verified enforcement), and allowed crossings stay silent.",[14,656,657,658,660,661,664],{},"The HTML export is fully self-contained — no external assets — so you can open it anywhere and print it. Both exports carry the same honest caveats shown on screen: they state that the report is a point-in-time snapshot of the ",[82,659,84],{}," posture (not a live or deployed-state scan), that findings are not rolled into a single risk number, and that no coverage percentage is implied. In the HTML report, each affirmed finding carries a ",[18,662,663],{},"\"Confirmed\""," tag, so a reader can see which risks you reviewed and confirmed.",[73,666,667],{},[14,668,669,672,673,675],{},[18,670,671],{},"Export is disabled while you have pending live edits."," If you've affirmed or disposed findings since the snapshot was generated, those decisions aren't yet in the snapshot — so the export buttons are disabled to stop you sharing stale numbers. Click ",[18,674,513],{}," to fold your decisions into a fresh snapshot, then export.",[73,677,679],{"className":678},[160,319],[14,680,681,683,684,686],{},[18,682,324],{}," An export reflects the snapshot it was taken from. If the on-screen banner reads stale, ",[18,685,513],{}," before exporting so you share current numbers.",[27,688],{},[30,690,692],{"id":691},"next-steps","Next Steps",[45,694,695,706,718,726,737],{},[48,696,697,701,702,480,704,331],{},[18,698,699],{},[474,700,366],{"href":476}," — the shared visual language, the ",[18,703,397],{},[18,705,425],{},[48,707,708,714,715,717],{},[18,709,710],{},[474,711,713],{"href":712},"\u002Fthreat-report\u002Funderstanding-coverage","Understanding Coverage"," — the ",[18,716,155],{}," MITRE ATT&CK matrix.",[48,719,720,725],{},[18,721,722],{},[474,723,170],{"href":724},"\u002Fthreat-report\u002Freachability"," — flow-route reachability for your crown jewels.",[48,727,728,714,732,734,735,331],{},[18,729,730],{},[474,731,585],{"href":584},[18,733,435],{}," ledger, recording decisions, and the ",[18,736,444],{},[48,738,739,745],{},[18,740,741],{},[474,742,744],{"href":743},"\u002Fthreat-report","Guide Index"," — the full Threat Report documentation set.",{"title":747,"searchDepth":748,"depth":748,"links":749},"",3,[750,752,753,756,757,758,759],{"id":32,"depth":751,"text":33},2,{"id":90,"depth":751,"text":91},{"id":176,"depth":751,"text":177,"children":754},[755],{"id":335,"depth":748,"text":336},{"id":365,"depth":751,"text":366},{"id":488,"depth":751,"text":489},{"id":590,"depth":751,"text":591},{"id":691,"depth":751,"text":692},"Generate, open, refresh, and export a threat report over a model","md",{"category":763,"position":751,"tags":764},"documentation",[765,39,766,767],"threat-report","getting-started","analysis",true,"\u002Fthreat-report\u002Fgetting-started",{"title":5,"description":760},"04.threat-report\u002F01.getting-started","uRDoXDwq5wVtqNGKplQPcnwDh07gk1u64QrdZmRyFfw",[774,829,864,919,941,985,1000,1070],{"title":775,"description":776,"path":777,"stem":778,"children":779,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[780,784,789,794,799,804,809,814,819,824],{"title":781,"path":777,"stem":782,"description":783},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":785,"path":786,"stem":787,"description":788},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":790,"path":791,"stem":792,"description":793},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":795,"path":796,"stem":797,"description":798},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":800,"path":801,"stem":802,"description":803},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":805,"path":806,"stem":807,"description":808},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":810,"path":811,"stem":812,"description":813},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":815,"path":816,"stem":817,"description":818},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":820,"path":821,"stem":822,"description":823},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":825,"path":826,"stem":827,"description":828},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":830,"description":831,"path":832,"stem":833,"children":834,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[835,839,844,849,854,859],{"title":836,"path":832,"stem":837,"description":838},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":840,"path":841,"stem":842,"description":843},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":845,"path":846,"stem":847,"description":848},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":850,"path":851,"stem":852,"description":853},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":855,"path":856,"stem":857,"description":858},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":860,"path":861,"stem":862,"description":863},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":865,"description":866,"path":867,"stem":868,"children":869,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[870,874,879,884,889,894,899,904,909,914],{"title":871,"path":867,"stem":872,"description":873},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":875,"path":876,"stem":877,"description":878},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":880,"path":881,"stem":882,"description":883},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":885,"path":886,"stem":887,"description":888},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":890,"path":891,"stem":892,"description":893},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":895,"path":896,"stem":897,"description":898},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":900,"path":901,"stem":902,"description":903},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":905,"path":906,"stem":907,"description":908},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":910,"path":911,"stem":912,"description":913},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":915,"path":916,"stem":917,"description":918},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":20,"description":920,"path":743,"stem":921,"children":922,"page":-1},"The residual-risk report over a threat model: reading it, filtering it and exporting it.","04.threat-report",[923,926,927,930,934,938],{"title":20,"path":743,"stem":924,"description":925},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":5,"path":769,"stem":771,"description":760},{"title":366,"path":476,"stem":928,"description":929},"04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":931,"path":712,"stem":932,"description":933},"Understanding Coverage and Gaps","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":935,"path":724,"stem":936,"description":937},"Reachability and Flow Routes","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":585,"path":584,"stem":939,"description":940},"04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":942,"description":943,"path":944,"stem":945,"children":946,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[947,951,956,961,966,971,975,980],{"title":948,"path":944,"stem":949,"description":950},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":952,"path":953,"stem":954,"description":955},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":957,"path":958,"stem":959,"description":960},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":962,"path":963,"stem":964,"description":965},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":967,"path":968,"stem":969,"description":970},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":366,"path":972,"stem":973,"description":974},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":976,"path":977,"stem":978,"description":979},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":981,"path":982,"stem":983,"description":984},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":986,"description":987,"path":988,"stem":989,"children":990,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[991,995],{"title":992,"path":988,"stem":993,"description":994},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":996,"path":997,"stem":998,"description":999},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1001,"description":1002,"path":1003,"stem":1004,"children":1005,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1006,1010,1015,1020,1025,1030,1035,1040,1045,1050,1055,1060,1065],{"title":1007,"path":1003,"stem":1008,"description":1009},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1011,"path":1012,"stem":1013,"description":1014},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1016,"path":1017,"stem":1018,"description":1019},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1021,"path":1022,"stem":1023,"description":1024},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1026,"path":1027,"stem":1028,"description":1029},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1031,"path":1032,"stem":1033,"description":1034},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1036,"path":1037,"stem":1038,"description":1039},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1041,"path":1042,"stem":1043,"description":1044},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1046,"path":1047,"stem":1048,"description":1049},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1051,"path":1052,"stem":1053,"description":1054},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1056,"path":1057,"stem":1058,"description":1059},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1061,"path":1062,"stem":1063,"description":1064},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1066,"path":1067,"stem":1068,"description":1069},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1071,"description":1072,"path":1073,"stem":1074,"children":1075,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1076,1080,1085],{"title":1077,"path":1073,"stem":1078,"description":1079},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1081,"path":1082,"stem":1083,"description":1084},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1086,"path":1087,"stem":1088,"description":1089},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184840]