threat-mitigation-mapping
It maps vulnerabilities to specific security controls to help prioritize investments and implement defense-in-depth strategies.
Install
mkdir -p .claude/skills/threat-mitigation-mapping && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/729" && unzip -o skill.zip -d .claude/skills/threat-mitigation-mapping && rm skill.zipInstalls to .claude/skills/threat-mitigation-mapping
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.Key capabilities
- →Categorize security controls into preventive, detective, and corrective types
- →Map threats across network, application, data, endpoint, and process layers
- →Apply defense-in-depth strategies to security architecture
- →Identify critical security gaps in existing infrastructure
- →Develop implementation roadmaps for risk treatment
How it works
The skill utilizes a structured framework to align identified threats with specific control categories and layers. It relies on a reference library to provide templates for scoring, reporting, and implementation planning.
Inputs & outputs
When to use threat-mitigation-mapping
- →Prioritizing security bug remediations
- →Planning defense-in-depth architecture
- →Validating security control effectiveness
- →Creating a risk treatment roadmap
About this skill
Threat Mitigation Mapping
Connect threats to controls for effective security planning.
When to Use This Skill
- Prioritizing security investments
- Creating remediation roadmaps
- Validating control coverage
- Designing defense-in-depth
- Security architecture review
- Risk treatment planning
Core Concepts
1. Control Categories
Preventive ────► Stop attacks before they occur
│ (Firewall, Input validation)
│
Detective ─────► Identify attacks in progress
│ (IDS, Log monitoring)
│
Corrective ────► Respond and recover from attacks
(Incident response, Backup restore)
2. Control Layers
| Layer | Examples |
|---|---|
| Network | Firewall, WAF, DDoS protection |
| Application | Input validation, authentication |
| Data | Encryption, access controls |
| Endpoint | EDR, patch management |
| Process | Security training, incident response |
3. Defense in Depth
┌──────────────────────┐
│ Perimeter │ ← Firewall, WAF
│ ┌──────────────┐ │
│ │ Network │ │ ← Segmentation, IDS
│ │ ┌────────┐ │ │
│ │ │ Host │ │ │ ← EDR, Hardening
│ │ │ ┌────┐ │ │ │
│ │ │ │App │ │ │ │ ← Auth, Validation
│ │ │ │Data│ │ │ │ ← Encryption
│ │ │ └────┘ │ │ │
│ │ └────────┘ │ │
│ └──────────────┘ │
└──────────────────────┘
Templates and detailed worked examples
Full template library and detailed mitigation/control mappings live in references/details.md. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.
Best Practices
Do's
- Map all threats - No threat should be unmapped
- Layer controls - Defense in depth is essential
- Mix control types - Preventive, detective, corrective
- Track effectiveness - Measure and improve
- Review regularly - Controls degrade over time
Don'ts
- Don't rely on single controls - Single points of failure
- Don't ignore cost - ROI matters
- Don't skip testing - Untested controls may fail
- Don't set and forget - Continuous improvement
- Don't ignore people/process - Technology alone isn't enough
When not to use it
- →Relying solely on a single security control
- →Ignoring cost and ROI in security planning
- →Treating security controls as static, set-and-forget implementations
Prerequisites
Limitations
- →Requires regular review as controls degrade over time
- →Cannot rely on technology alone without considering people and processes
How it compares
This method forces a multi-layered defense approach rather than relying on individual security tools to address vulnerabilities.
Compared to similar skills
threat-mitigation-mapping side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| threat-mitigation-mapping (this skill) | 5 | 2mo | No flags | Intermediate |
| reverse-engineering-tools | 73 | 4mo | No flags | Advanced |
| game-hacking-techniques | 42 | 2mo | No flags | Advanced |
| solidity-security | 15 | 2mo | No flags | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by wshobson
View all by wshobson →You might also like
reverse-engineering-tools
gmh5225
Guide for reverse engineering tools and techniques used in game security research. Use this skill when working with debuggers, disassemblers, memory analysis tools, binary analysis, or decompilers for game security research.
game-hacking-techniques
gmh5225
Guide for game hacking techniques and cheat development. Use this skill when researching memory manipulation, code injection, ESP/aimbot development, overlay rendering, or game exploitation methodologies.
solidity-security
wshobson
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
1password
openclaw
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
senior-security
davila7
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
ghidra
mitsuhiko
Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.