Collaborative Threat Modeling

Collaborative Threat Modeling

Work with your team in real-time on threat models.

Overview

TMI supports real-time collaborative threat modeling, allowing multiple team members to work together simultaneously.

Real-Time Features

Simultaneous Editing

• Multiple users can edit the same threat model at once
• Changes appear immediately for all users
• WebSocket-based synchronization
• No need to refresh or manually save

Visual Indicators

• See who else is viewing/editing
• View collaborator cursors in diagrams
• See active users list
• Real-time change notifications

Conflict Prevention

• Automatic conflict resolution
• Coordinated updates via WebSocket
• Redis-based synchronization
• Optimistic locking where needed

Sharing Threat Models

Managing Access

1. Open your threat model
2. Click "Share" or "Manage Access"
3. Add collaborators by email/username
4. Set permission levels
5. Send invitations

Permission Levels

Owner:

• Full control over threat model
• Can delete threat model
• Can manage all permissions
• Can transfer ownership

Writer:

• Can edit all content
• Can add/modify diagrams, threats, notes
• Can add comments
• Cannot manage permissions or delete

Reader:

• View-only access
• Can view all content
• Can add comments
• Cannot edit

Inviting Collaborators

• Enter email address or username
• Select permission level
• Add optional message
• Send invitation

Collaboration Workflows

Design Review Sessions

1. Share threat model with team
2. Join video/voice call
3. Collaboratively edit diagrams
4. Identify threats together
5. Document decisions in notes

Async Collaboration

1. Share threat model
2. Team members review and add threats
3. Use comments for discussion
4. Owner reviews and consolidates
5. Track changes over time

Security Review

1. Development team creates initial model
2. Security team reviews as Reader
3. Security adds threats and comments
4. Development team addresses findings
5. Iterate until approved

Best Practices

Communication

• Coordinate major changes
• Use comments for questions
• @mention team members
• Use external chat for complex discussions

Organization

• Assign sections to team members
• Use consistent naming conventions
• Document assumptions in notes
• Regular synchronization points

Etiquette

• Small, incremental changes
• Communicate before major edits
• Review others' changes
• Acknowledge contributions

Comments and Discussions

Adding Comments

• Select component, threat, or note
• Click "Add Comment"
• Write your comment
• @mention users to notify them

Comment Threads

• Reply to comments
• Mark as resolved
• Track conversations
• Link to related items

Change Tracking

Activity Feed

• See recent changes
• Who made what changes
• When changes occurred
• Navigate to changed items

Audit Trail

• Complete history
• User attribution
• Timestamps
• Change details

Notifications

Notification Types

• New comments
• @mentions
• Major changes
• Permission changes
• Shared threat models

Notification Preferences

Configure in user settings:

• Email notifications
• In-app notifications
• Notification frequency
• Specific event types

Next Steps

• Review Managing Threats
• Learn about Issue Tracker Integration
• Explore Using Notes and Documentation