ThreatSpider: CTI-Driven Semi-Automated Threat Modelling for Cybersecurity Certification

Threat modelling is a critical component of cybersecurity risk management, especially in the context of secure system development and certification. This paper introduces ThreatSpider, a semi-automated threat modelling framework driven by Cyber Threat Intelligence (CTI) sources, designed to streamline the identification of threats, mitigations, and cybersecurity requirements throughout the system development lifecycle. By leveraging multiple CTI feeds, such as ATT&CK, ATLAS, EMB3D, SPARTA, and NVD, ThreatSpider enables the continuous generation of up-to-date threat models tailored to the ever-evolving threat landscape. The tool’s systematic and automated approach reduces manual effort and analysis time, supporting industries in maintaining agile development practices while seeking compliance with cybersecurity standards like IEC 62443 and ISO 27001. The evaluation of ThreatSpider across diverse use cases highlights its adaptability, effectiveness, and potential to become an essential instrument for cybersecurity certification efforts. Future enhancements will address identified limitations, such as extending support to additional technology domains, harmonizing system property granularity, and integrating threat prioritization and risk assessment functionalities.