Frameworks

No single framework catches everything — each one was built to answer a different question about the same system. You start each from its own workspace; once running they work concurrently, and Scvltori reconciles what they find.

What each one is actually asking#

STRIDE: what can this specific component do wrong? The general-purpose baseline — Microsoft's original framework, still the right starting point for any system.
MITRE ATT&CK: what techniques does a real attacker use? Built from documented real-world incidents, and the natural fit for teams already doing threat hunting or incident response.
LINDDUN: where does this system violate privacy — even without an attacker? The only framework here that asks this question independent of whether anything was technically "broken into."
PASTA: what does this threaten in business terms? Where STRIDE says a component is vulnerable, PASTA says what that vulnerability actually costs — in money, in regulatory exposure — if it's exploited.
NIST AI RMF: what risk does this AI or ML component introduce? Covers the threats specific to models — poisoning, extraction, hallucination, bias — that the other six frameworks aren't built to see.
OWASP TOP 10: what are the most common ways web applications actually get broken? More specific and more directly actionable for developers than STRIDE's broader categories.
SBOM: which third-party components are a liability? Supply-chain risk — the dependencies and libraries a system is built on, not the system itself.

The framework selector: each one starts and tracks its own assessment, with its own completion state.

How they reconcile#

When two or more frameworks flag the same underlying issue on the same component, Scvltori collapses it into one canonical finding instead of listing it twice — and a threat multiple methodologies agree on is treated as a higher priority than one only a single framework caught. That convergence is calculated per component, not project-wide: the same category of issue showing up on two different components stays two separate findings, each with its own score.

Choosing frameworks for your system#

STRIDE is the floor for any project. Beyond that, it depends on what you're building:

WEB APPLICATION WITH USER DATA: STRIDE + OWASP Top 10 + LINDDUN.
FINANCIAL OR PAYMENTS SYSTEM: STRIDE + PASTA + MITRE ATT&CK.
ANYTHING WITH AN AI OR ML COMPONENT: STRIDE + NIST AI RMF, on top of whatever else the system needs.
A FORMAL AUDIT OR FULL REVIEW: all seven.

What the analysis actually reads#

Three inputs, in order of how much they matter: your project description (what the system does, who uses it, what data it touches), your assets, and your dataflows. There's no separate configuration step — the richer those three are, the more specific and useful what comes back, and a handful of well-described assets consistently outperforms a large pile of vague ones.