The Threat Modeler
The pen test should confirm what you already knew — not introduce you to your attack surface.
The incident
The annual pen test found the SSRF in the PDF-rendering service — a URL parameter that would happily fetch internal metadata endpoints. The fix took a day. The uncomfortable math took longer: the vulnerable code had shipped eleven months earlier, which meant eleven months of exposure, purchased at the price of skipping one design-time question: 'what happens if this URL is hostile?'
Why the obvious approach fails
Annual pen tests and pre-launch reviews audit a snapshot, but the attack surface changes with every merge — a new parameter, a new integration, a new file upload. Security as a phase means every vulnerability enjoys a free exposure window between shipping and the next audit. And relying on developer vigilance alone fails the same way all vigilance fails: statistically, under deadline. The countermeasure is to move the checks to where the change happens: automated OWASP-class heuristics on every merge (injection surfaces, SSRF patterns, deserialization, authz gaps), plus a lightweight threat-model conversation triggered by risk signals — new external input, new privilege boundary, new data flow — while the design is still cheap to change.
The standard
- Every merge runs automated security heuristics — SAST for the OWASP Top 10 classes, dependency and container scanning — as a gate, not a report.
- Risk-triggering changes (new external inputs, new authz boundaries, new data egress) require a threat-model pass at plan time: attacker, asset, path, mitigation — one page, not a workshop.
- Findings have severity budgets: critical blocks the merge, high blocks the release, everything is triaged with an owner and a date.
- The dependency tree is continuously scanned with an SBOM maintained — the supply chain is part of the surface.
- Every incident and pen-test finding becomes a permanent automated check — the class of bug, not just the instance, is retired.
How Cortex validates it
At plan time
Cortex flags risk-triggering patterns in the plan itself (new input surfaces, boundary changes) and requires the threat-model artifact before build.
At validation
assert: merge_gate.security_scans == passedassert: critical_findings.open == 0 at releaseassert: risk_flagged_changes.threat_model_attached == 100%Assertion syntax is illustrative.
At review
the approver sees the security evidence with the diff: scan results, the threat-model note for flagged changes, and the finding budget — before sign-off, not after launch.