Study guide
3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
Key Takeaways Explain This Topic AI
STRIDE is a Microsoft-origin qualitative model that labels threats as Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, or Elevation of privilege.
DREAD is a rating model — Damage potential, Reproducibility, Exploitability, Affected users, Discoverability — used to score and rank findings rather than merely name them.
OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a CERT/SEI organizational, asset-driven risk method, not a pentest execution standard.
A single finding can be labeled with STRIDE categories and separately scored with DREAD so stakeholders see both the threat type and the priority.
PTES includes a threat-modeling phase; STRIDE/DREAD/OCTAVE are the named frameworks CompTIA expects you to contrast for that work.
Last updated: August 2026
PT0-003 lists three threat modeling frameworks under objective 1.3: STRIDE , DREAD , and OCTAVE . PTES even includes a dedicated threat-modeling phase, but PTES tells you when to threat-model in a pentest. These three tell you how to think about threats. They are not interchangeable. STRIDE labels a threat. DREAD scores it so you can rank work. OCTAVE starts from operationally critical assets inside the organization. If you only memorize the expansions, you will miss scenario items that ask which model to apply.
STRIDE: Qualitative Threat Categories
STRIDE originated at Microsoft as a design-time threat-classification model.
Property mapping
Each letter is a threat type, and each type maps to a security property you are trying to protect:
- Letter Threat Property violated Pentest example
- S Spoofing Authentication Calling an API as another customer by swapping a user ID
- T Tampering Integrity Altering a payment amount in a hidden field
- R Repudiation Non-repudiation Admin actions with no immutable audit log
- I Information disclosure Confidentiality IDOR that returns another tenant's invoices
- D Denial of service Availability Unauthenticated endpoint that exhausts workers
- E Elevation of privilege Authorization www-data to root via a sudo misconfiguration
STRIDE is qualitative . You walk a data-flow or an attack path and ask, "which of these six can happen here?" A single finding often earns more than one letter: an unauthenticated command injection is commonly Elevation of privilege plus Tampering plus Information disclosure, and it may also enable Denial of service if the host can be crashed or encrypted.
On the exam, STRIDE is the answer when the stem wants you to categorize threats, run a design review, or name the type of attack a control is meant to stop. It is not a 0-to-10 formula and not an organizational workshop about which business asset is operationally critical.
DREAD: A Scoring and Ranking Model
DREAD is the quantitative-ish companion people confuse with STRIDE because both have Microsoft heritage. DREAD rates a specific finding so you can compare it with other findings:
D amage potential — how bad is success (data loss, safety, ransomware, fraud)?
R eproducibility — can you hit it every time, or only in a race?
E xploitability — how much skill, access, or tooling does the attacker need?
A ffected users — one intern laptop, one plant, or every customer?
D iscoverability — would a skilled attacker find this without your notes?
Scoring 0-10
Each factor is commonly scored 0–10 . Teams then average (or sometimes sum) the five numbers to produce a priority. DREAD is not a formal ISO standard and Microsoft moved away from it for product design, but it remains on the PT0-003 list because it teaches ranking . Two "high" STRIDE-labeled issues are not equal if one is a reliable unauthenticated RCE affecting all customers and the other is a local DoS on a lab VLAN.
DREAD is the answer when the stem wants you to score, rate, or prioritize a finding. It is the wrong answer when the stem wants threat categories (STRIDE) or an organizational asset workshop (OCTAVE).
Worked Example: One Finding, Two Models
Finding: an Internet-facing payments API accepts an unsanitized reportId parameter that yields command injection as www-data . A world-writable sudoers drop-in then elevates to root. The host can reach the cardholder database. Logs are local, rotatable by root, and not shipped to a SIEM.
STRIDE labels (what kind of threats are present):
Spoofing — the API does not authenticate the caller before running reportId .
Tampering — root on the payment host can alter settlement records.
Repudiation — the attacker can wipe or rotate local logs, so actions may not be attributable.
Information disclosure — cardholder data is reachable.
Denial of service — the same access could crash or encrypt the host.
Elevation of privilege — www-data to root via sudoers.
Those letters tell developers which properties failed . They do not, by themselves, tell the CISO whether to patch tonight or next quarter.
DREAD scores (how bad is this instance, 0–10):
- Factor Score Rationale
- Damage potential 9 Cardholder database plus ransomware-capable root
- Reproducibility 8 Injection is reliable against the live parameter
- Exploitability 7 Needs the sudoers chain, but both steps are straightforward
- Affected users 9 All customers of the payment application
- Discoverability 6 Not a public CVE, but the parameter is guessable
- Average 7.8 Treat as high/critical for reporting and likely immediate escalation
Same evidence, two jobs: STRIDE names the threat types; DREAD produces a number you can rank against a stored XSS that scores a 4. If the DREAD damage and affected-user scores are this high on production, you also invoke the escalation path from the previous section — you do not wait for the closing meeting to mention ransomware-capable root.
OCTAVE: Organizational, Asset-Driven Risk
OCTAVE stands for Operationally Critical Threat, Asset, and Vulnerability Evaluation . It comes from CERT at Carnegie Mellon University's Software Engineering Institute (SEI) , not from Microsoft. OCTAVE is a self-directed organizational risk assessment . It starts with what the business cannot afford to lose — operationally critical information assets and the processes around them — then evaluates threats and vulnerabilities in that operational context, and produces a security strategy the organization can own.
Later SEI work includes OCTAVE Allegro , a streamlined, information-asset-focused variant designed so a small team can finish an assessment without a huge consulting footprint. For PenTest+ you do not need to recite every Allegro worksheet. You need the contrast:
OCTAVE asks, "which assets are operationally critical, and what would a threat to those assets do to the mission?"
- STRIDE asks, "which of six threat types apply to this component?"
- DREAD asks, "what score does this finding get so we know what to fix first?"
OCTAVE is not a pentest execution standard. It will not tell you how to exploit a sudoers file. It will tell a tester during pre-engagement that "payment processing" and "batch control for line 2" are the crown jewels, which is why those systems show up in the RoE and why a DREAD 7.8 on the payment API is not just another web finding. If an exam stem mentions operationally critical assets , organizational evaluation , or CERT/SEI , pick OCTAVE. If it mentions six threat categories , pick STRIDE. If it mentions damage, reproducibility, and a numeric rating, pick DREAD.
Model Origin Style Typical output Pentest use
STRIDE Microsoft Qualitative categories Labeled threat types mapped to security properties Design review; labeling findings
DREAD Microsoft rating model Semi-quantitative 0–10 factors A score used to rank issues Prioritize exploitation and reporting
OCTAVE CERT/SEI Organizational, asset-driven Risk picture tied to critical operational assets Pre-engagement: know the crown jewels
How the Three Fit an Engagement
Use OCTAVE-style thinking (or the client's existing BIA) to learn which assets are operationally critical before you spend hours on a low-value VLAN. Use STRIDE while reading architecture diagrams and data flows so you do not miss repudiation or spoofing just because the scanner is quiet. Use DREAD when you have too many confirmed findings and must decide what to exploit next and what to lead with in the executive summary.
Do not force one model to do the others' jobs. Scoring "Spoofing = 8" is not STRIDE. Holding a three-day asset workshop to classify a single XSS is not OCTAVE as CompTIA is using it. Listing DREAD letters without numbers is just a worse STRIDE. Match the framework to the question: label, score, or evaluate the organization.