threat-mitigation-mapping

Use it when:: You have a list of threats and must decide which security controls to invest in, check what they cover, or plan remediation.
It does:: Maps each threat to controls by type (prevent, detect, correct) and by layer (network, application, data, endpoint, process), checking for defense in depth.
You get:: A mitigation report: executive summary, defense-in-depth coverage, critical gaps, recommendations and an implementation roadmap.
Also has:: Python templates for a control library tied to STRIDE threat categories (spoofing, tampering, repudiation and so on), budget-limited control selection and control effectiveness tests.

TL;DR

The step after finding threats: deciding what stops them. Controls are sorted by what they do, preventing an attack (firewall, input validation), detecting one in progress (intrusion detection, log monitoring) or recovering from it (incident response, backup restore), and by layer, from network and application to data, endpoints, and people and process. Defense in depth means each threat meets several layers and kinds of control, so no single control is a point of failure. Its Python templates model threats, controls and coverage; hold a library of standard controls, such as multi-factor authentication, with cost, effectiveness and compliance references; compute risk reduction and critical gaps; choose controls within a budget; generate a roadmap and a report; and test whether controls work. The rules: leave no threat unmapped, layer and mix control types, weigh cost, test controls, review them regularly, and don't rely on technology alone.

Summarizes the skill at 4bde316.

npx skills add https://github.com/wshobson/agents --skill threat-mitigation-mapping

skills.sh page Source on GitHub All skills from wshobson/agents

Total Downloads: 21,200 on skills.sh, Nov 9, 2026
Repo stars: 42,334 wshobson/agents
First seen: Jan 20, 2026 on skills.sh

Weekly Downloads

507

-47% over the 8 weeks to Nov 9

Weekly values

Week to	Installs
Sep 21	949
Sep 28	1,159
Oct 5	1,185
Oct 12	867
Oct 19	853
Oct 26	984
Nov 2	964
Nov 9	507

Category	category:security category:software-engineering Compliance, guardrails, skill vetting and browser fingerprinting. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills.
Type	type:guidelines Knowledge and rules the agent applies while it works: best practices, design principles, API references.
Effect	effect:none Adds no side effects of its own. It shapes how the agent thinks, writes or reviews. Guidelines and routers are always effect:none, even when the task they support edits code.
Needs	needs:none Instructions only. Works in any agent that supports skills.
Publisher	by:community Everyone else. Unverified vendor claims default to community.
Topics	security

SKILL.md

From wshobson/agents at 4bde316. Checked daily, last changed Nov 6, 2026.

Frontmatter

name: threat-mitigation-mapping
description: Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

Threat Mitigation Mapping

Connect threats to controls for effective security planning.

When to Use This Skill

Prioritizing security investments
Creating remediation roadmaps
Validating control coverage
Designing defense-in-depth
Security architecture review
Risk treatment planning

Core Concepts

1. Control Categories

Preventive ────► Stop attacks before they occur
   │              (Firewall, Input validation)
   │
Detective ─────► Identify attacks in progress
   │              (IDS, Log monitoring)
   │
Corrective ────► Respond and recover from attacks
                  (Incident response, Backup restore)

2. Control Layers

Layer	Examples
Network	Firewall, WAF, DDoS protection
Application	Input validation, authentication
Data	Encryption, access controls
Endpoint	EDR, patch management
Process	Security training, incident response

3. Defense in Depth

                    ┌──────────────────────┐
                    │      Perimeter       │ ← Firewall, WAF
                    │   ┌──────────────┐   │
                    │   │   Network    │   │ ← Segmentation, IDS
                    │   │  ┌────────┐  │   │
                    │   │  │  Host  │  │   │ ← EDR, Hardening
                    │   │  │ ┌────┐ │  │   │
                    │   │  │ │App │ │  │   │ ← Auth, Validation
                    │   │  │ │Data│ │  │   │ ← Encryption
                    │   │  │ └────┘ │  │   │
                    │   │  └────────┘  │   │
                    │   └──────────────┘   │
                    └──────────────────────┘

Templates and detailed worked examples

Full template library and detailed mitigation/control mappings live in references/details.md. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.

Best Practices

Do's

Map all threats - No threat should be unmapped
Layer controls - Defense in depth is essential
Mix control types - Preventive, detective, corrective
Track effectiveness - Measure and improve
Review regularly - Controls degrade over time

Don'ts

Don't rely on single controls - Single points of failure
Don't ignore cost - ROI matters
Don't skip testing - Untested controls may fail
Don't set and forget - Continuous improvement
Don't ignore people/process - Technology alone isn't enough