Forrester Total Economic Impact^™ of IriusRisk Threat Modeling

The main point of threat modeling is to highlight some of those issues that could occur and to put mitigating controls prior to them ever being an issue in the code. It's much cheaper to find those issues at the beginning.

IriusRisk allows us to make changes at the design stage. It reduces risk and the financial impact in case of breaches or downtime. In banking, reducing risk is enough argument to introduce a new tool.

As part of our secure software development lifecycle, one requirement is that teams must address all the required countermeasures in IriusRisk. They are required to hit the security bar right at the beginning. That shift-left has helped us to get the security as part of the design before hands ever touched the keyboard, saving us a lot of potential remediation time.

IriusRisk seamlessly integrates with issue trackers, and it forms part of the developer’s workflow.  Additionally, the principal software architect at a software sales company explained that IriusRisk supports bi-directional communication when integrated to an issue tracker. Scaling is much quicker with IriusRisk because of the reusable architectures and the ability to drag and drop previous models. Moreover, users can reuse library content.

We have seen an increase in developers creating better architecture diagrams and documentation because of using IriusRisk. Previously, we had developers who worked on their very specific piece of code for this product. When they saw the whole picture, they had kind of an ‘aha-moment’.

​​IriusRisk allows us to query flaws via API, meaning that we can query threats in our database. This is important for auditing processes. It's a lot easier to provide them with a list of vulnerabilities when compliance requests this. It saves us time.

IriusRisk can be integrated to our JIRA system. Tickets are automatically assigned. Automation really helps here. As you write the threats, you are writing it into the system, so everything is in IriusRisk.

We discover the weaknesses, threats, and countermeasures, and we can map our customized risk patterns to a new or to an existing component. We use that capability extensively.