We’ve published TRACE as a paper. TRACE: A Threat Modelling Methodology for Distributed, Cloud-First, and Decentralized Organisations is on arXiv, and it’s the fullest write-up of the method we’ve put out so far.
The short version of the argument:
The threat modelling methods most teams reach for (STRIDE, PASTA, Trike, OCTAVE, LINDDUN, attack trees, MITRE ATT&CK) were built for a world that doesn’t match how modern organisations actually run. They assume a security perimeter you can draw a line around, a single organisation that owns everything inside it, and a clean split between technical risk and operational risk.
Modern teams break all three assumptions. They run on cloud and SaaS control planes they don’t own. Authority over the assets that matter is spread across founders, contractors, vendors, signers, committees, and automation. And value leaves through human approval ceremonies and supply-chain edges, not through a network boundary someone is watching.
So the failures that actually cost money are the ones those methods mostly skip: an authorised person doing something malicious, collusion between parties that are supposed to be independent, a compromised CI/CD or control plane, and plain operational mishandling of high-value actions.
TRACE treats the things that matter as first-class, evidence-linked objects: threat actors, roles, assets, critical invariants, and the trust and authority edges between them. It models across three layers at once (protocols, systems, and organisations), runs as a gated sequential workflow, and sets out a discipline for human-AI co-working where language models widen coverage but senior reviewers keep judgement over invariants, severity, and collusion.
The paper also compares nine common frameworks across ten dimensions and shows where each one falls short once you’re in a distributed, cloud-first, zero-trust setting.
TRACE came out of our Web3 security work, but the method is stack-agnostic. For the practical side: the framework overview walks through the model, the spec and materials are on GitHub, and AiTM runs the workflow as a desktop app.