Map identified threats to appropriate security controls

Threat mitigation mapping

by wshobson · MIT license · ★ 39,857 on GitHub · updated Sep 21

Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

---
name: threat-mitigation-mapping
description: Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.
---

# Threat Mitigation Mapping

Connect threats to controls for effective security planning.

## When to Use This Skill

- Prioritizing security investments
- Creating remediation roadmaps
- Validating control coverage
- Designing defense-in-depth
- Security architecture review
- Risk treatment planning

Overview

Connect threats to controls for effective security planning.

Manual install (npx, ZIP)

Claude Codenpx skills add wshobson/agents --skill threat-mitigation-mapping -g -a claude-code

Claude Code (manual)

mkdir -p ~/.claude/skills && curl -sL https://codeload.github.com/wshobson/agents/tar.gz/4236bb91f839 \
  | tar -xz -C ~/.claude/skills --strip-components=4 agents-4236bb91f839/plugins/security-scanning/skills/threat-mitigation-mapping

Windows (PowerShell)

New-Item -ItemType Directory -Force "$HOME\.claude\skills" | Out-Null; Invoke-WebRequest "https://m.agentalley.io/zip/7844c4e48557c7f81f55/threat-mitigation-mapping.zip" -OutFile "$env:TEMP\threat-mitigation-mapping.zip"; Expand-Archive "$env:TEMP\threat-mitigation-mapping.zip" -DestinationPath "$HOME\.claude\skills" -Force

Claude.ai / desktopDownload the ZIP and upload it under Settings → Capabilities → Skills.

Codex, Cursor, other agentsPoint them at SKILL.md. The other files are plain text.

Connects with Agent Alley MCP · agentalley.io/mcp

Files included

SKILL.md3.3 KB
references/1 file · 23.0 KB

Read the files here

wshobson/4236bb92 files

SKILL.md3.3 KB

SKILL.md

Show the full text83 lines

threat-mitigation-mapping/SKILL.md83 lines · 3.3 KB

PreviewCode

Outline

RawView on GitHub

Threat Mitigation Mapping

Connect threats to controls for effective security planning.

When to Use This Skill

Prioritizing security investments
Creating remediation roadmaps
Validating control coverage
Designing defense-in-depth
Security architecture review
Risk treatment planning

Core Concepts

1. Control Categories

Preventive ────► Stop attacks before they occur
   │              (Firewall, Input validation)
   │
Detective ─────► Identify attacks in progress
   │              (IDS, Log monitoring)
   │
Corrective ────► Respond and recover from attacks
                  (Incident response, Backup restore)

2. Control Layers

Layer	Examples
Network	Firewall, WAF, DDoS protection
Application	Input validation, authentication
Data	Encryption, access controls
Endpoint	EDR, patch management
Process	Security training, incident response

3. Defense in Depth

                    ┌──────────────────────┐
                    │      Perimeter       │ ← Firewall, WAF
                    │   ┌──────────────┐   │
                    │   │   Network    │   │ ← Segmentation, IDS
                    │   │  ┌────────┐  │   │
                    │   │  │  Host  │  │   │ ← EDR, Hardening
                    │   │  │ ┌────┐ │  │   │
                    │   │  │ │App │ │  │   │ ← Auth, Validation
                    │   │  │ │Data│ │  │   │ ← Encryption
                    │   │  │ └────┘ │  │   │
                    │   │  └────────┘  │   │
                    │   └──────────────┘   │
                    └──────────────────────┘

Templates and detailed worked examples

Full template library and detailed mitigation/control mappings live in references/details.md. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.

Best Practices

Do's

Map all threats - No threat should be unmapped
Layer controls - Defense in depth is essential
Mix control types - Preventive, detective, corrective
Track effectiveness - Measure and improve
Review regularly - Controls degrade over time

Don'ts

Don't rely on single controls - Single points of failure
Don't ignore cost - ROI matters
Don't skip testing - Untested controls may fail
Don't set and forget - Continuous improvement
Don't ignore people/process - Technology alone isn't enough

1	---
2	name: threat-mitigation-mapping
3	description: Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.
4	---
5
6	# Threat Mitigation Mapping
7
8	Connect threats to controls for effective security planning.
9
10	## When to Use This Skill
11
12	- Prioritizing security investments
13	- Creating remediation roadmaps
14	- Validating control coverage
15	- Designing defense-in-depth
16	- Security architecture review
17	- Risk treatment planning
18
19	## Core Concepts
20
21	### 1. Control Categories
22
23	```
24	Preventive ────► Stop attacks before they occur
25	│ (Firewall, Input validation)
26	│
27	Detective ─────► Identify attacks in progress
28	│ (IDS, Log monitoring)
29	│
30	Corrective ────► Respond and recover from attacks
31	(Incident response, Backup restore)
32	```
33
34	### 2. Control Layers
35
36	\| Layer \| Examples \|
37	\| --------------- \| ------------------------------------ \|
38	\| Network \| Firewall, WAF, DDoS protection \|
39	\| Application \| Input validation, authentication \|
40	\| Data \| Encryption, access controls \|
41	\| Endpoint \| EDR, patch management \|
42	\| Process \| Security training, incident response \|
43
44	### 3. Defense in Depth
45
46	```
47	┌──────────────────────┐
48	│ Perimeter │ ← Firewall, WAF
49	│ ┌──────────────┐ │
50	│ │ Network │ │ ← Segmentation, IDS
51	│ │ ┌────────┐ │ │
52	│ │ │ Host │ │ │ ← EDR, Hardening
53	│ │ │ ┌────┐ │ │ │
54	│ │ │ │App │ │ │ │ ← Auth, Validation
55	│ │ │ │Data│ │ │ │ ← Encryption
56	│ │ │ └────┘ │ │ │
57	│ │ └────────┘ │ │
58	│ └──────────────┘ │
59	└──────────────────────┘
60	```
61
62	## Templates and detailed worked examples
63
64	Full template library and detailed mitigation/control mappings live in `references/details.md`. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.
65
66	## Best Practices
67
68	### Do's
69
70	- Map all threats - No threat should be unmapped
71	- Layer controls - Defense in depth is essential
72	- Mix control types - Preventive, detective, corrective
73	- Track effectiveness - Measure and improve
74	- Review regularly - Controls degrade over time
75
76	### Don'ts
77
78	- Don't rely on single controls - Single points of failure
79	- Don't ignore cost - ROI matters
80	- Don't skip testing - Untested controls may fail
81	- Don't set and forget - Continuous improvement
82	- Don't ignore people/process - Technology alone isn't enough
83