Know who would come for you, how, and what stops them.
We map your most important systems against the way real attackers operate, then show you which controls would stop them and which gaps to close first. Risk you can explain to your board, and a plan your engineers can act on.
Most security plans are built around controls, not attackers.
Boards ask what could actually happen to the organisation. Most security programs answer with a list of controls and a compliance score. Budget goes to the next tool rather than the threat most likely to cause harm, and nobody can say with confidence whether the SOC would see a real attack in progress.
How Nueva helps
Strategic risk, tested against real attacker behaviour.
We combine two proven frameworks. NIST risk management gives the strategic view: what matters most to your organisation, how likely each threat is and what it would cost you. MITRE ATT&CK, the global knowledge base of real adversary tactics and techniques, gives the tactical view: how an attacker would get in, move through your environment and reach what matters. Together they turn an abstract risk register into an evidence-based defence plan.
Lateral movementFlat networkNo segmentation to financeGap
Stopped / DetectedGap to close
Illustrative example. Physical entry points are modelled with Nueva Secure.
WHAT WE MODEL
Where we apply it
New systems and major change. Applications, cloud platforms and integrations, modelled at design stage, when fixes cost least.
Critical business services. Finance, customer data, operational systems and the services you can't run without.
Identity and cloud. Entra ID, Active Directory, Microsoft 365 and cloud tenancies, where most modern attacks pivot.
AI systems. Models, agents and the data they reach, using MITRE ATLAS alongside ATT&CK.
Suppliers and third parties. The access your vendors and service providers hold into your environment.
Physical entry points. Where building access, CCTV and network-connected devices create a path into digital systems, with Nueva Secure.
WHAT YOU RECEIVE
What's in a Nueva threat model
An executive summary of your top threats, in business terms, for your board and leadership team
A model of your systems and data flows, showing trust boundaries and the assets an attacker would target
Likely attack paths, mapped to MITRE ATT&CK techniques
Each risk rated for likelihood and business impact, using NIST risk assessment methods
A control and detection gap analysis: what would stop each path, and whether your SOC would see it
A prioritised roadmap, ranked by risk reduction
Nueva Cyber
A project or a partnership. Your call.
A defined engagement
Professional services
A scoped threat model of one system, one service or your whole environment, with a report, a debrief for your technical and executive teams, and a prioritised roadmap.
Kept current as your environment and the threat landscape change, reviewed after major change, and used to tune SOC detections and target penetration testing.
How is threat modelling different from a risk assessment?
A risk assessment tells you which risks matter. Threat modelling shows how each one would actually happen, step by step, so you know exactly which controls and detections stop it. We do both together.
How is it different from a penetration test?
A threat model works out where an attacker would go and why. A penetration test proves whether they can get there. Modelling first makes testing sharper; testing afterwards proves the fixes hold.
When should we do it?
Ideally at design stage, before a system goes live, when changes cost least. It's equally valuable for existing critical services, and after a major change, an acquisition or an incident.
What do you need from us?
Time with the people who know the systems, any architecture and data-flow documentation you have, and a clear view of what matters most to the business. We fill the gaps in workshops.
Can you threat model AI systems?
Yes. We use MITRE ATLAS, the companion framework to ATT&CK for AI, to model risks such as prompt injection, data leakage and agent misuse.
THREAT MODELLING