Threat modelling is not an audit: The creative, human work behind real security

Audits are paint-by-numbers. Threat modelling is closer to art.

Many organisations reach a point where they have the process of threat modelling in place—templates, methodologies, tools—but the outcomes still feel underwhelming. The diagrams are tidy, the threats are familiar, and the real surprises never surface. The missing ingredient is rarely technical rigor; it’s creative, human engagement.

This talk explores threat modelling as an inherently creative and collaborative discipline—less like checkers, more like chess played in a crowded room with people who see the board very differently. Building on a previous session about establishing a threat modelling practice, this talk focuses on what practitioners actually struggle with once the basics are in place: imagination, group dynamics, trust, and facilitation.

Aimed at security architects, product security leaders, senior engineers, and anyone who runs or participates in threat modelling sessions, this talk covers:

• Why effective threat modelling requires creativity—and how to encourage it without drifting into fantasy
• How to design sessions that invite genuine exploration rather than compliance theatre
• Techniques for fostering psychological safety, openness, and blame-free discussion
• Navigating stakeholders, power imbalances, and conflicting incentives without losing momentum
• The "so what?" is simple and practical: the quality of your threat models is bounded by the quality of the conversations you create. 

Attendees will walk away with concrete techniques for facilitating better discussions, unlocking more original thinking, and transforming threat modelling from a mechanical exercise into a shared, engaging practice that measurably improves security outcomes.