# Faultlines

> A deterministic first look at where risk concentrates in your system.

- Source: https://stevenfoerster.com/lab/faultlines/

Lab

A deterministic first look at where risk concentrates in your system.

## Faultlines

A deterministic first look at where risk concentrates in your system.

- No large language model
- Client-side
- Deterministic

What this is

A deterministic threat-modeling pass that surfaces likely failure modes without machine learning or external data. Use it to map trust boundaries, identity, secrets, and deployment risk before deeper review.

Runs entirely in your browser. Nothing is sent to a server.

Who it's for

-   Builders who want a fast architecture risk scan.
-   Security engineers preparing for design reviews.
-   Product teams defining zero-trust boundaries.

Builder notes

This lab is intentionally practical: it is a deterministic pre-review pass to surface risk concentration before deeper threat modeling.

-   Run a preset profile first to establish a baseline.
-   Change one control at a time and observe score deltas.
-   Export markdown and challenge each recommendation in design review.

Learning resources

-   [STRIDE threat model reference](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats)
-   [NIST SP 800-207 (Zero Trust)](https://csrc.nist.gov/publications/detail/sp/800-207/final)
-   [AWS Well-Architected Security Pillar](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html)

Use these as review frameworks; this lab provides fast triage, not full risk quantification.

### Security Posture

Adjust inputs to improve your posture. Changes update in real-time.

Live

Posture Score

—

High-Risk Faultlines

—

Goal: zero

Status

Fill in the form to see your risk profile.

### Inputs

SaaS Hybrid Multi-tenant Enterprise Healthcare Serverless IoT OSS

Step 1 - System profile

System type Deployment Exposure Multi-tenancy Data sensitivity Industry/constraints (optional)

Step 2 - Access & secrets

Identity Privileged access pattern Secrets handling

Step 3 - Operations & change

Change rate Observability Incident history (optional)

Step 4 - Notes (optional)

System notes (max 500 chars)

Character count: 0/500

Analyze Reset

### Risk Profile

\-

Risk Radar

Faultline Scores

Trust Boundaries

### Attack Chains

Click to navigate

How compromises cascade between faultlines. Higher scores increase chain severity.

### Top Faultlines

### Trust Boundary Flow

### Faultline Details

### Questions to ask next

### Export & Share

Copy Link Copy Markdown Download JSON Copy Summary

### How Faultlines works

-   Rule-based scoring grounded in explicit, inspectable logic.
-   Deterministic: the same inputs always produce the same outputs.
-   Designed to surface likely risk concentrations and next questions.

## Key Concepts

### STRIDE Threat Model

STRIDE categorizes threats into six types: **S**poofing identity, **T**ampering with data, **R**epudiation, **I**nformation disclosure, **D**enial of service, and **E**levation of privilege. Faultlines maps your inputs to these categories to identify which threat types your system is most exposed to.

### Trust Boundaries

A trust boundary is any point where data or control crosses between zones of different privilege. For example, user input reaching a backend API, or a service calling another with elevated permissions. Threats concentrate at these boundaries because assumptions change.

### Scoring Methodology

Each faultline is scored 0–100 based on weighted risk factors: exposure level, control maturity, data sensitivity, and compensating controls. Higher scores indicate greater risk concentration. The posture score aggregates all faultlines into a single readiness measure.

### Attack Chains

Attackers rarely exploit a single weakness. Attack chains show how compromising one faultline enables escalation to the next. For example, stolen credentials leading to lateral movement, then data exfiltration. Reducing any link in the chain reduces overall risk.