Continuous Application
Threat Modeling Service

What is Fork?

Fork  is a SaaS platform that implements the PASTA framework for threat modeling. Our goal is to create a tool that not only serves the needs of security professionals but also evolves with the contributions of the community.

Comprehensive Mapping of Taxonomies

Our ForkTM platform is expanding its scope to encompass mapping all relevant taxonomies. In ForkTM, we strive to provide a holistic approach by integrating both theory and evidence methodologies. Fork’s evidence-based approach complements your threat models and helps identify additional Tactics, Techniques, and Procedures (TTPs) for consideration in the attack tree. These adversarial methods are derived from real-world attacks observed and reported by legitimate sources.

Fork is incorporating threats and adversarial methods derived from multiple categories of observed behavior:

• TTPs used against your Technology Platform(s)
• Software used maliciously against your Industry
• Campaign(s) targeting your Industry

Our threat libraries are designed as a tree, providing a hierarchical mapping of various security standards, frameworks, and methodologies. Within this tree structure, you can explore different branches such as threats, motives, targets, CWEs (Common Weakness Enumeration), CAPECs (Common Attack Pattern Enumeration and Classification), CVEs (Common Vulnerabilities and Exposures), MITRE ATT&CK post-exploitation patterns along with their corresponding mitigations, and OWASP ASVS (Application Security Verification Standard). This approach allows for an intuitive understanding of how these elements interconnect and relate to one another within your threat models.

Risk Centric Threat Modeling Under Two Hours

Identify risks that are most likely to happen and which create the biggest impact. Harnesses our industry-focused threat libraries and integrate real-time vulnerability data and threat intelligence.

• Proprietary Residual Risk Formula

  Ensure relevant threats are quantified accurately and mitigated effectively.

• Quality Gates

  Enforce rigorous security standards at every stage of the threat modeling process, ensuring consistent, high-quality assessments.

• Business Impact Analysis

  Gain insight into how fundamental security pillars are affected and understand the potential financial implications of data breaches and downtime to your organization.

A Single Pane of Glass for Security Insights

Unveil a new perspective on your application’s security posture with our unified view. Transform intricate threat data into actionable insights, by merging relevant industry threats with your application’s attack surface, and cyber threat intelligence.

• Integrated Industry Taxonomies

  Our platform automatically correlates threat data with trusted frameworks and standards from MITRE and OWASP including CWE, CVE with EPSS, CAPEC, ATT&CK, D3FEND and ASVS to drive targeted mitigations and actionable insights.

• On-Demand Security Testing

  Substantiate the viability of potential threats by requesting targeted testing of specific weaknesses, vulnerabilities, and attack patterns directly from your threat models.

• Collaborative Workflows

  Empower your security and product teams with integrated workflows that allow you to dismiss items, create custom entries and relationships, all in real-time.

Threat Modeling from Sprint 1

Harnesses the proven benefits of threat modeling, enabling your teams to identify and integrate security-driven design principles directly into your software from day one.

• Relevant in Every Stage

  Adapt your threat models to your application’s current lifecycle stage – from planning and design to maintenance, ensuring every assessment is contextually applicable and practical.

• Build Once, Evolve Continuously

  Develop your threat model at the outset and update it as your application progresses, keeping your security approach focused on the evolving risk landscape.

• Threat Modeling for Every Role

  Built on threat modeling principles that streamline workflows for diverse stakeholders, from product teams and security experts to business operations.

Integrations

Supercharge your threat modeling process by integrating Fork with your existing AppSec tooling.

Leverage the PASTA Methodology

Brought to you by a co-author of the Process for Attack Simulation and Threat Analysis (PASTA) methodology, our platform is a practical implementation of the renowned risk-centric, business-aligned threat modeling framework that raises the bar far beyond traditional approaches.

• Risk-Centric Focus

  Prioritizes threats based on business impact rather than just technical vulnerabilities.

• Real-World Simulation

  Emulates realistic attack scenarios to uncover potential weaknesses.

• Comprehensive Analysis

  Merges technical and business perspectives for a well-rounded threat assessment.

• Iterative Process

  Allows continuous refinement and adaptation as threats evolve

As modern software development evolves at a rapid pace, so must our approach to threat modeling. Continuous threat modeling is crucial for maintaining an up-to-date understanding of your application’s security posture, especially within dynamic and agile environments. Fork, our SaaS threat modeling platform built on the PASTA (Process for Attack Simulation and Threat Analysis) framework, provides an innovative solution that enables continuous threat modeling to be seamlessly integrated into your software development lifecycle.

Integrating Threat Intelligence for a Live, Evolving Threat Model

A key feature of Fork is its ability to integrate with different providers, allowing it to ingest data from various sources such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and manual penetration test findings. This ensures that your threat model is not a static, one-time exercise but an evolving, live model that adapts to the changing threat landscape.

These integrations allow Fork to continuously pull in the latest threat intelligence and vulnerability data, ensuring your threat model is always up-to-date. Additionally, Fork can push this data to issue-tracking platforms, enabling your development teams to address security issues in real-time and keep track of ongoing security efforts. This live threat model provides your organization with an accurate and current view of potential risks, enhancing your ability to respond to emerging threats.

Automating the Mapping to Industry Standard Taxonomies

With Fork, you can regularly sync all your integrated sources and automatically map them to existing industry-standard taxonomies directly within your threat library. This feature ensures that your threat data is organized and structured in a way that is both comprehensive and understandable. By adhering to recognized taxonomies, Fork allows your security and development teams to communicate more effectively and align with industry best practices.

When changes occur in your threat model, whether through new findings or shifts in the risk landscape, Fork will send out in-app and email notifications. These alerts inform you whenever the status of residual risk moves above or below your predefined quality gates. This ensures that you are always aware of your application’s current security posture and can respond quickly to any changes.

Tracking Historical Data for Continuous Improvement

One of Fork’s standout features is its ability to store historical data and present it in an easy-to-understand chart format. This allows you to track how your application’s security posture has changed over time, providing invaluable insights into the most significant contributing factors to your risk profile. By analyzing these trends, your team can identify areas for improvement and make informed decisions about where to focus security efforts. This ongoing visibility helps ensure that your threat modeling efforts are not just a one-time activity but an integral part of your application’s lifecycle.

Supporting Both Application and Component-Based Threat Modeling

Fork is designed to support threat modeling for entire applications, enabling you to consider the existing attack surface and associated vulnerability data. In addition, it is equipped to handle component-based threat modeling, which allows Agile and Scrum teams to perform recurring threat modeling sessions for individual components or features as they are being planned. This capability helps teams identify and address potential threats earlier in the development cycle, fostering a proactive security mindset.

By incorporating threat modeling at the component level, teams can ensure that security is considered from the outset, reducing the risk of costly architectural changes and technical debt later in the development process. This approach saves developer hours and allows software engineers to focus on building features rather than constantly reacting to security issues.

Fork enables continuous threat modeling by integrating with threat intelligence sources, automating the mapping to industry-standard taxonomies, providing real-time notifications, and tracking historical data to offer an up-to-date and evolving view of your security posture. With its support for both application and component-based threat modeling, Fork further enhances your organization’s ability to be agile, adaptable, and always prepared to address the latest threats, ensuring that security remains an integral and ongoing part of your software development process.

GET STARTED

What problems does Fork help security teams solve?

Fork helps organizations move threat modeling beyond static diagrams, workshops, and security checklists. It creates an evolving view of application risk by connecting application context, business impact, threat intelligence, vulnerability findings, security controls, and realistic attack scenarios.

This helps security and development teams determine which threats are relevant, which weaknesses are most likely to be exploited, and which remediation activities should receive priority.

Who should use Fork?

Fork is designed for organizations that need to operationalize threat modeling across application security, product security, DevSecOps, engineering, risk, and business teams.

It is particularly useful for organizations that:

• Develop or maintain business critical applications
• Operate in regulated or high risk industries
• Need to scale threat modeling across multiple applications
• Want to connect threat models with security testing and vulnerability data
• Need clearer communication between technical teams and business stakeholders
• Want to prioritize remediation according to business impact and residual risk

How is Fork different from IriusRisk and ThreatModeler?

IriusRisk and ThreatModeler provide enterprise threat modeling platforms focused on automation, architecture analysis, secure design workflows, threat libraries, integrations, and organization wide threat modeling.

Fork takes a different approach by implementing the risk centric PASTA threat modeling methodology and connecting technical threats directly to application context, business impact, attack viability, and residual risk.

Key Fork differentiators include:

• A practical implementation of the seven stage PASTA methodology
• Business impact analysis integrated into the threat model
• Risk prioritization that considers business, product, and security impact
• A proprietary residual risk formula and configurable quality gates
• Evidence based mapping across CWE, CVE, EPSS, CAPEC, MITRE ATT&CK, MITRE D3FEND, OWASP ASVS, and other security taxonomies
• The ability to connect identified threats with targeted adversarial testing
• Optional access to VerSprite security experts for exploitability analysis and validation
• Support for both application level and component level threat modeling

Fork is therefore well suited for organizations that want threat modeling to support risk based decision making and adversarial validation, rather than functioning only as an architecture analysis or compliance documentation process.

Does Fork replace IriusRisk or ThreatModeler?

Fork can be evaluated as an alternative to IriusRisk or ThreatModeler, but the best choice depends on the organization’s threat modeling objectives.

Organizations primarily seeking automated architecture modeling, extensive component libraries, or broad infrastructure visualization may evaluate those platforms alongside Fork.

Organizations seeking PASTA based threat modeling, business aligned risk analysis, residual risk measurement, and a direct connection between threat modeling and adversarial security testing may find Fork better aligned with their requirements.

How does Fork prioritize application security risk?

Fork evaluates risk using application context, threat relevance, vulnerability data, attack likelihood, existing countermeasures, business impact, and residual exposure.

Instead of treating every vulnerability or theoretical threat equally, Fork helps teams focus on the scenarios most likely to create meaningful harm to the organization, its customers, its operations, or its regulated data.

Can Fork connect threat modeling with penetration testing?

Yes. Fork can connect threat model findings with targeted adversarial testing.

Through Fork Enterprise PT, organizations can request testing of specific weaknesses, vulnerabilities, attack paths, and threat scenarios directly from the threat model. VerSprite security experts can then evaluate whether the modeled threat is practically exploitable and provide evidence to support remediation decisions.

This allows security teams to validate risk rather than relying exclusively on theoretical likelihood scores.

Can Fork integrate with our existing application security tools?

Fork is designed to integrate with application security and development workflows, including data from SAST, DAST, software composition analysis, vulnerability management, penetration testing, threat intelligence, and issue tracking platforms.

These integrations help keep threat models aligned with changes in the application and its security posture while reducing the need to manually recreate findings across multiple systems.

Available integrations should be confirmed during the evaluation process based on your current technology stack and workflow requirements.

How long does it take to build a threat model with Fork?

Fork is designed to help teams develop a risk centric threat model in under two hours when the necessary application and business context is available.

The exact time depends on application complexity, architecture maturity, available documentation, integrations, and the depth of analysis required. Models can then be refined continuously as the application, attack surface, and threat landscape evolve.

Can Fork support threat modeling across multiple applications?

Yes. Fork Enterprise supports unlimited applications and threat models, organizational units, multiple team members, granular permissions, SSO, audit logs, and edit history.

This allows organizations to manage threat modeling at the application, portfolio, business unit, or enterprise level while maintaining appropriate access controls and governance.

Can development teams use Fork without becoming threat modeling experts?

Yes. Fork is designed to support collaboration between security, development, product, architecture, risk, and business teams.

Security teams can establish the methodology, quality gates, threat libraries, and governance requirements, while developers and product teams contribute application context, architectural changes, components, and remediation updates.

This helps distribute threat modeling across the software development lifecycle without requiring every participant to become a dedicated threat modeling specialist.

Does Fork support regulatory and compliance requirements?

Fork can help organizations document threats, weaknesses, controls, countermeasures, residual risk, decisions, and historical changes.

Its mappings to recognized security frameworks and taxonomies can support secure development, risk management, audit preparation, and compliance activities. However, Fork should be used as part of a broader compliance program and does not independently guarantee compliance with any regulation or standard.

Can we try Fork before purchasing an enterprise subscription?

Yes. Fork Community allows organizations to create a threat model for one application with a single user at no cost.

Organizations that need multiple applications, additional users, integrations, access controls, SSO, audit history, or managed adversarial testing can evaluate Fork Enterprise or Fork Enterprise PT.

What is included with Fork Enterprise PT?

Fork Enterprise PT combines the Fork Enterprise platform with access to targeted security testing and exploitability analysis.

This option is intended for organizations that want security experts to validate whether modeled threats, vulnerabilities, and attack paths can be exploited in practice. It provides a direct connection between threat modeling, offensive security testing, evidence collection, and remediation prioritization.

What should we prepare before evaluating Fork?

A productive Fork evaluation typically includes:

• A representative application or service
• Architecture diagrams or technical documentation
• The application’s business purpose and key users
• Data classifications and regulatory requirements
• Existing SAST, DAST, SCA, vulnerability, or penetration testing results
• Current security controls and countermeasures
• Business impact criteria
• The teams that will participate in threat modeling and remediation

This information allows the evaluation to demonstrate how Fork connects technical findings with real application and business risk.

How do we determine whether Fork is the right threat modeling platform for us?

Fork may be a strong fit when your organization needs to:

• Align threat modeling with measurable business risk
• Operationalize the PASTA methodology
• Maintain threat models throughout the application lifecycle
• Integrate vulnerability and threat intelligence data
• Measure residual risk after controls are applied
• Validate modeled threats through adversarial testing
• Give security, development, product, and business teams a shared view of application risk

The most effective evaluation is to build a threat model for a representative application and compare the resulting risks, attack scenarios, remediation priorities, and workflow against your current process.