STRIDE, applied honestly
STRIDE is a Microsoft-originated taxonomy — Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. This site references the six category names as terms of art and links to the framework rather than reproducing it; every table below is this estate's own.
The shape the flagship review uses
The flagship threat model runs all six STRIDE categories as tables of threat × likelihood × impact × mitigation status, cross-referenced to a numbered vulnerability. The honest part is the status column: it is populated with NOT MITIGATED as often as MITIGATED.
| STRIDE category | What it asks | This estate's finding shape |
|---|---|---|
| Spoofing | Can an actor claim an identity that isn't theirs? | Findings scored, mitigation status recorded per finding — see the flagship review's own table, held under the disclosure rule while any remain open |
| Tampering | Can data be modified without authorisation? | Same shape — likelihood, impact, status, cross-referenced vulnerability id |
| Repudiation | Can an action be denied after the fact? | Same shape |
| Information disclosure | Can data reach someone not entitled to see it? | Same shape — this is the category the zero-knowledge finding below sits under |
| Denial of service | Can the system be made unavailable? | Same shape |
| Elevation of privilege | Can an actor gain access beyond what they were granted? | Same shape |
The one category that reaches a conclusion most vendor models never print
For the server-breach case, impact is recorded as NONE — mitigated by design through the estate's zero-knowledge architecture. That is a stronger claim than most threat models make about their own worst case, so the review does not leave it as an assertion: Section 6 is a dedicated zero-knowledge verification, not a line in a table.
Section 9: Assumptions and Open Questions
The flagship model carries a dedicated section naming what it assumes and what it does not yet know — the house rule of publishing tensions unresolved, showing up in this estate's own security work eight months before this site's commissioning pack applied the same rule to itself.
A 37-entry risk register
The flagship review closes with a risk register spanning 37 entries. The register itself, with its per-file locations, stays held under the disclosure rule while any entries remain open; what is publishable is the shape — a register, not a document, with each entry carrying a status rather than being implicitly assumed fixed once written down.