Your vulnerability scanner will never flag an API that any internal machine can call without logging in. Nothing is broken. It was built that way.
Here’s threat modeling explained for people who already run infrastructure. We walk an internal HR portal through Adam Shostack’s four questions and all six STRIDE categories, show why a CVSS 9.8 isn’t always the emergency, and connect it all to the Threat & Control Method.
Then you’ll run your first threat model on one small system in about an hour. Want the diagram, the STRIDE table, and every source? Read the full written guide.
