---
title: "Plan attacks before building · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/threat-model
updated: 2026-10-20
licence: "All rights reserved"
---

# Plan attacks before building

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- Rule: Before building a feature, write down what an attacker would want from it and how they could get it. Then design those paths away.
- How: For each feature, list the data, the money and the actions at stake. Note who could abuse each one, such as a stranger, a customer or a staff member. A checklist such as STRIDE names six kinds of threat to walk through. Turn each abuse into a test case.
- Check: Every feature that handles money, accounts or personal data has a short threat list, and each item links to a test.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/threat-model`.

- Previous: [Send the security headers](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/security-headers)
- Next: [Publish what is in each release](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance)
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)