--- title: "STRIDE, STRIDE Threat Model | MedTech Terms" description: "A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/stride#term", "name": "STRIDE Threat Model", "alternateName": "STRIDE", "description": "STRIDE is a threat-classification taxonomy developed by Microsoft in the late 1990s and now the de-facto threat-modeling vocabulary in medical device cybersecurity. The acronym stands for Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, and Elevation of privilege - six classes of threat that map onto the security properties of authentication, integrity, non-repudiation, confidentiality, availability, and authorization. STRIDE is used to systematically walk every element of a data-flow diagram and ask, for each, which of the six threat classes apply and how they would be mitigated.", "url": "https://medtechterms.com/terms/stride", "termCode": "stride", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/stride#article", "headline": "STRIDE, STRIDE Threat Model", "description": "A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.", "url": "https://medtechterms.com/terms/stride", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/stride" }, "about": { "@id": "https://medtechterms.com/terms/stride#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "STRIDE Threat Model, STRIDE, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "Microsoft Threat Modeling - STRIDE", "url": "https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats", "publisher": { "@type": "Organization", "name": "Microsoft" } }, { "@type": "CreativeWork", "name": "FDA Cybersecurity Guidance (Sept 2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "MDCG Cybersecurity Guidance", "url": "https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en", "publisher": { "@type": "Organization", "name": "MDCG" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/threat-modeling#term", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/aami-tir57#term", "name": "AAMI TIR57", "url": "https://medtechterms.com/terms/aami-tir57" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "url": "https://medtechterms.com/terms/spdf" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "STRIDE Threat Model", "item": "https://medtechterms.com/terms/stride" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/stride#faq", "mainEntity": [ { "@type": "Question", "name": "What's the difference between STRIDE-per-element and STRIDE-per-interaction?", "acceptedAnswer": { "@type": "Answer", "text": "STRIDE-per-element walks each DFD element through all six categories. STRIDE-per-interaction walks each data flow's source/destination/data combinations. Per-interaction is more thorough; per-element is faster. Most MedTech teams use per-element for breadth and per-interaction on high-risk paths." } }, { "@type": "Question", "name": "Does STRIDE cover safety risks?", "acceptedAnswer": { "@type": "Answer", "text": "STRIDE classifies threats; the safety implications are evaluated separately in your ISO 14971 risk management file. The bridge between them is required - every STRIDE-identified threat that could cause patient harm must be evaluated as a safety risk." } }, { "@type": "Question", "name": "Is STRIDE outdated?", "acceptedAnswer": { "@type": "Answer", "text": "It's older but still effective for systematic enumeration. For complex systems, teams often combine STRIDE with attack trees or LINDDUN (privacy-focused) for richer coverage." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. STRIDE Threat Model [All terms](/terms) Cybersecurity [AI / ML in Devices](/ecosystems/ai-ml)[Connected & Cyber-Physical Devices](/ecosystems/connected-devices)STRIDE # STRIDE Threat Model A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition STRIDE is a threat-classification taxonomy developed by Microsoft in the late 1990s and now the de-facto threat-modeling vocabulary in medical device cybersecurity. The acronym stands for Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, and Elevation of privilege - six classes of threat that map onto the security properties of authentication, integrity, non-repudiation, confidentiality, availability, and authorization. STRIDE is used to systematically walk every element of a data-flow diagram and ask, for each, which of the six threat classes apply and how they would be mitigated. What the regulation says FDA's 2023 cybersecurity guidance and [AAMI TIR57](/terms/aami-tir57):2016 both reference STRIDE as an example threat-modeling methodology. FDA does not mandate STRIDE specifically, but reviewers expect the threat model to use a recognized methodology applied systematically - STRIDE is by far the most common in submissions and reviewers are accustomed to its structure. ## What this means in practice STRIDE shines when paired with a data-flow diagram (DFD) that shows trust boundaries between subsystems. The team walks each element (process, data store, external entity, data flow) across each STRIDE category, recording threats, likelihood/impact, and mitigations. The output feeds the cybersecurity risk assessment and links to [ISO 14971](/terms/iso-14971) safety harms. Common pitfalls - • Applying STRIDE without a current data-flow diagram - there's nothing systematic to walk. - • Conflating STRIDE categories (e.g., logging Information disclosure threats as Tampering). - • Stopping at threat enumeration without scoring likelihood/impact and selecting mitigations. ## Frequently asked questions What's the difference between STRIDE-per-element and STRIDE-per-interaction? STRIDE-per-element walks each DFD element through all six categories. STRIDE-per-interaction walks each data flow's source/destination/data combinations. Per-interaction is more thorough; per-element is faster. Most MedTech teams use per-element for breadth and per-interaction on high-risk paths. Does STRIDE cover safety risks? Is STRIDE outdated? ## Cross-references ### Used by Things that build on this term. - [ Threat Modeling ](/terms/threat-modeling) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. ](/terms/threat-modeling)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf) ### FDA Cybersecurity 101 · From this learning path [ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. Adjacent lesson ](/terms/sbom?from=fda-cybersecurity-101)[ Cybersecurity Common Vulnerabilities and Exposures(CVE) A globally unique identifier for a publicly disclosed cybersecurity vulnerability. ](/terms/cve?from=fda-cybersecurity-101)[ Cybersecurity Common Vulnerability Scoring System(CVSS) An industry-standard 0–10 score that quantifies the severity of a software vulnerability. ](/terms/cvss?from=fda-cybersecurity-101)[ Cybersecurity CycloneDX A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. ](/terms/cyclonedx?from=fda-cybersecurity-101) Cited by Where this term appears across MedTech Terms. Learning paths (1) - [FDA Cybersecurity 101](/paths/fda-cybersecurity-101)Lesson 5 of 11 Ecosystems (2) - [AI / ML in Devices](/ecosystems/ai-ml) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 Microsoft· 1 FDA· 1 MDCG· 1 1. [1 Microsoft Threat Modeling - STRIDE Verified Microsoft · learn.microsoft.com ](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats) 2. [2 FDA Cybersecurity Guidance (Sept 2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) 3. [3 MDCG Cybersecurity Guidance Verified MDCG · health.ec.europa.eu ](https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym STRIDE Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=stride) Learn in 60 seconds Card Lesson Quiz A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. - · STRIDE shines when paired with a data-flow diagram (DFD) that shows trust boundaries between subsystems. - · The team walks each element (process, data store, external entity, data flow) across each STRIDE category, recording threats, likelihood/impact, and mitigations. - · The output feeds the cybersecurity risk assessment and links to ISO 14971 safety harms. Remember this Watch out: Applying STRIDE without a current data-flow diagram - there's nothing systematic to walk. Related terms - [Threat Modeling ](/terms/threat-modeling) - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [AAMI TIR57 ](/terms/aami-tir57) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) - [Secure Product Development Framework(SPDF) ](/terms/spdf) You may also need Auto-suggested from Cybersecurity and shared keywords. - [LINDDUN ](/terms/linddun) - [Healthcare and Public Health Cybersecurity Performance Goals(HPH-CPG) ](/terms/hph-cpg) - [MITRE ATT&CK(ATT&CK) ](/terms/mitre-attack) - [MITRE D3FEND(D3FEND) ](/terms/mitre-d3fend) - [SOC 2 ](/terms/soc-2) - [Common Vulnerability Scoring System(CVSS) ](/terms/cvss) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)