Threat Modeling

Nominations for Threat Modeling

Nominations are open

Enter this category by February 27, 2027. Anyone can submit an entry: the company, the nominee, a colleague or an agency.

Nominate in this category

About the Threat Modeling category

What belongs in this category

The Threat Modeling category covers products that help architects, developers and security teams think through how a system could be attacked while it is still being designed. Typical entries build a model from diagrams, code or cloud definitions, apply methods such as STRIDE, which checks a design against six types of threat, and threat libraries, suggest controls, turn the results into tasks developers can work on, and keep models current as the design changes.

Testing code and running applications fits Application Security, which a threat modeling product may also enter, and checks inside the build pipeline fit DevSecOps. Mapping attack paths through a live environment fits Cyber Exposure Management or Adversarial Exposure Validation (AEV).

Related categories to enter

Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.

Application Security — for testing the code once it is written

DevSecOps — for security checks during development

Application Security Posture Management (ASPM) — for tracking design risks beside code findings

Cyber Exposure Management — for attack paths across a live environment

Product Security Platform — for threat models kept as part of product security duties

Adversarial Exposure Validation (AEV) — for testing whether modeled attacks work against the live environment

How entries are judged

An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.

Strong entries in this category show:

Leadership — the design work the product supports: systems and applications modeled, teams using it, and customers that make threat modeling a routine part of design.

Innovation — a threat modeling problem solved in a new way, such as models generated from existing diagrams or code, threats suggested by AI for review, or models that update when the design changes.

Impact — results for customers: design flaws found before coding, time to complete a threat model, share of new projects modeled, security requirements turned into developer tasks. Give figures from customers.

The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.

How to enter

A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.