VAST

VAST is an approach to threat modeling built for agility, automation, and integration across the software delivery lifecycle. It focuses on making threat analysis scalable for development teams by embedding it into workflows, rather than relying on slow, manual reviews that quickly fall out of date as systems change.

Expanded Definition

VAST, which stands for Visual, Agile, and Simple Threat modeling, is a method for embedding threat analysis into product delivery so that security decisions can keep pace with modern software change. It is designed to reduce friction between security and engineering by making threat modelling repeatable, lightweight, and available early enough to influence architecture, backlog prioritisation, and release readiness. Unlike heavyweight workshop-driven approaches, VAST is meant to scale across teams and services without requiring every review to start from scratch.

Usage in the industry is still evolving, and definitions vary across vendors and practitioners. Some teams treat VAST primarily as a modelling workflow, while others use it as a broader operating model for integrating threat analysis into DevSecOps. For that reason, VAST is best understood as a practical approach rather than a rigid standard, even though it aligns well with governance ideas reflected in the NIST Cybersecurity Framework 2.0. The most common misapplication is treating VAST as a one-time diagramming exercise, which occurs when teams create a model at design time but never update it as code, infrastructure, or dependencies change.

Examples and Use Cases

Implementing VAST rigorously often introduces process discipline and tooling overhead, requiring organisations to weigh faster delivery decisions against the cost of maintaining current threat models.

• A platform team adds VAST checks to pull requests so that major authentication, data-flow, or privilege changes trigger threat analysis before merge.
• A product security team uses VAST to compare the risk profile of multiple microservices and focus deeper review on externally exposed, high-value components.
• A DevSecOps pipeline integrates threat prompts into release workflows, so developers can capture design assumptions and likely abuse cases during feature planning.
• An engineering organisation uses VAST to keep threat models aligned with service decomposition, cloud migrations, and new API exposures rather than revisiting them only at audit time.
• A security architect uses VAST outputs to inform control selection and risk treatment in line with the NIST Cybersecurity Framework 2.0 and internal governance requirements.

Why It Matters for Security Teams

VAST matters because threat modelling fails when it is too slow to influence engineering decisions. If analysis happens late, teams miss design flaws, rework becomes expensive, and risk decisions are made with incomplete context. A VAST approach helps security teams shift from periodic review to continuous risk visibility, which is especially important in environments with frequent releases, multiple service owners, and rapidly changing attack surfaces.

For identity-heavy systems, VAST also helps teams reason about authentication flows, privileged access paths, secrets handling, and trust boundaries around non-human identities and automation. That makes it useful where application security and identity governance overlap, particularly when services, agents, or integrations can act with execution authority. Organisations typically encounter the operational cost of weak threat modelling only after a breach, a failed release, or a major redesign, at which point VAST becomes operationally unavoidable to address.