1.
The review happens right before launch
If anyone writes a threat model at all, it’s usually the week before release. By then the architecture is settled and the date is fixed, so most findings end up as backlog tickets or accepted risks.
Threat modeling for product teams
Oko reads your design docs and tells you what could go wrong.
Connect the specs, design docs and tickets your team already writes. For each new one, Oko works out what’s changing, where the trust boundaries are and how someone could abuse it, then writes up what to fix. You find out while it’s still a draft and easy to change.
- 25 free Reviews a month
- No credit card
- Read-only access
High · SpoofingProcessor webhooks change balances, and nothing checks they’re real. Verify signatures, reject replays.
Med · Privilege misuseAnyone in support can change where payouts go. Add a second approver and email the owner.
Works with →
- Jira
- Confluence
- Google Docs
- Notion
- Linear
- GitHub
- GitLab
- Slack
The problem
Plenty of security bugs start as a line in a design doc.
Someone decides the webhook doesn’t need auth, or that support should be able to change payout details, and nobody with a security background sees it until much later. Scanners can’t help, because there’s no code yet. Threat modeling can, but most teams can’t do it often enough.
2.
There’s more to review than people to do it
A proper threat model takes a few hours. Most security teams are a handful of people, and they can’t do one for every spec and ticket that touches auth, payments or customer data.
3.
Threat models go stale fast
Someone writes one, files it in the wiki, and then the design changes. Nobody updates it, and the findings rarely make it into the tickets engineers work from.
How it works
Connect your tools once. Oko takes it from there.
- 1
Connect
Give Oko read-only access to your docs, tickets and repos. It takes a few minutes.
- 2
Learn your system
Oko reads what’s already there and works out your services, where data flows, the trust boundaries and the controls you already have.
- 3
Model each design
When someone writes a new spec, Oko works out what changed, which boundaries it crosses and which threats actually matter.
- 4
Post the fixes
Short, testable security requirements go into the ticket, and your security team can see the full history.
What you get
Oko does the legwork. Your team makes the calls.
Most of the time in a threat model goes into reading the doc, sketching the data flows and walking through the list of threats. Oko does that part, using your architecture and your own security standards, and leaves the judgment to your security team.
Data flows
Pulled from the doc
Oko reads the design doc and works out the pieces: components, data stores and the trust boundaries between them.
Threats
Checked one by one
Every piece is checked against STRIDE and your own security standards, so the usual suspects don’t get skipped because someone was in a hurry.
Risk
Ranked for your system
Threats are rated for likelihood and impact based on your architecture and the controls you already have. Something you’ve already handled won’t show up as critical.
Fixes
Written as requirements
Each threat comes with a specific requirement an engineer can build and test, posted in the ticket where the work is planned.
Updates
Kept up to date
When the spec changes, the threat model changes with it, and Oko shows you which threats are new.
Review
Signed off by your team
Your security team edits, approves or escalates. Every threat, decision and accepted risk is versioned, so you can always see who decided what.
On GitHub
Agentic threat modeling skills for your terminal.
A set of skills you can add to an AI coding agent like Claude Code, Codex, Cursor or Gemini CLI. Point your agent at a repo and it writes a threat model based on the code. They’re Apache-2.0 licensed and you don’t need an account.
# Claude Code
claude plugin marketplace add oko-security/oko-skills
claude plugin install oko@oko# Codex, Cursor, Gemini CLI, OpenCode and others
npx skills@latest add oko-security/oko-skills/threat-model bootstrap ./my-serviceWrites a THREAT_MODEL.md from the code and its history, ranked by risk./threat-model guided .Writes a draft, then works through it with whoever owns the system./threat-model-diff main..my-branchTells you whether a branch changes the threat model./threat-model-export jsonExports to JSON, OTM, a Mermaid data flow diagram or tickets.
Who it’s for
It’s not just for the security team.
AppSec
Cover every design, even the small ones.
Oko writes the first draft of every threat model. Your team spends its time on the ones that need a closer look.
Learn more →Engineering
Find out before you build it.
You get the security requirements while you’re still picking an approach, instead of as a blocker the week before release.
Learn more →Product
Know what security will add.
See what a feature needs on the security side before it goes on the roadmap, so it’s part of the estimate.
Learn more →Try it on your next design doc.
Try it free for 30 days. You don’t need a credit card, and nobody will try to book a call with you.