The Process for Attack Simulation and Threat Analysis (PASTA) is a risk-centric threat modeling methodology that explicitly focuses on simulating real-world attacks from an adversary's perspective. Unlike STRIDE or DREAD, which classify threats and rate severity, PASTA evaluates how an attacker would exploit vulnerabilities step by step.
PASTA has seven stages, including defining objectives, decomposing applications, and simulating attacks.
This methodology helps organizations understand both technical and business risks by looking at the application as an attacker would.
STRIDE categorizes threats, DREAD provides scoring, and ATASM emphasizes architecture and mitigation.
While valuable, they are not primarily attack-simulation frameworks. PASTA enables proactive testing of defenses against realistic adversary behaviors, making it especially relevant in modern cloud and DevSecOps environments.