v0.6.0 Release Notes¶

Release Date: 2026-05-02

This release introduces comprehensive security enhancements including role-based guidance, risk quantification, threat intelligence, purple team capabilities, supply chain security, and attack path analysis.

Highlights¶

Role-based security data for Red Team, Blue Team, and Remediation workflows
FAIR risk assessment with annualized loss expectancy calculations
Enhanced STIX 2.1 export with IOCs, detection rules, and threat actors
Purple team capabilities with Atomic Red Team mapping and detection coverage matrix
Security metrics tracking (MTTD, MTTR, detection rates)
Supply chain security with SBOM integration and VEX statements
SSVC vulnerability prioritization with automated decision trees
Attack graph analysis with path finding and risk calculation algorithms
OWASP Agentic Security Top 10 (ASI 2026) support

What's New¶

OWASP ASI Support¶

Support for the new OWASP Agentic Security Top 10 (2026) for AI agent threats:

Category	Value	Description
API Security	`api`	API Security Top 10 (2023)
LLM Applications	`llm`	LLM Application Top 10 (2025)
Web Applications	`web`	Web Application Top 10 (2021)
Agentic Applications	`agentic`	Agentic Top 10 (ASI 2026)

Attack steps can now include asiIds for OWASP Agentic Security mappings:

{
  "step": 6,
  "from": "gateway",
  "to": "agent",
  "label": "Access agent",
  "asiIds": ["ASI02:2026", "ASI03:2026"],
  "owaspIds": ["API8:2023"]
}

Reference data is available for all 40 OWASP entries via GetOWASPEntry() and ValidateOWASPID().

Role-Based Security Guidance¶

Red Team¶

Exploitation guidance for penetration testers:

{
  "redTeam": {
    "prerequisites": ["Target must have WebSocket gateway enabled"],
    "exploitationSteps": [
      {"order": 1, "action": "Host malicious page", "tool": "Python HTTP server"}
    ],
    "tools": [{"name": "Burp Suite", "purpose": "WebSocket interception"}],
    "difficulty": "low"
  }
}

Blue Team¶

Defense guidance with detection rules:

{
  "blueTeam": {
    "detectionRules": [
      {
        "name": "Cross-Origin WebSocket",
        "format": "sigma",
        "rule": "title: Cross-Origin WebSocket Connection..."
      }
    ],
    "iocs": [
      {"type": "pattern", "value": "ws://localhost:*", "confidence": 0.9}
    ],
    "huntingQueries": [
      {"name": "Find WS connections", "language": "splunk", "query": "..."}
    ]
  }
}

Remediation¶

Developer guidance for fixing vulnerabilities:

{
  "remediation": {
    "codePatterns": [
      {
        "language": "javascript",
        "vulnerable": "// No origin check",
        "secure": "if (origin !== allowedOrigin) { ws.close(); }"
      }
    ],
    "checklist": [
      {"item": "Validate WebSocket Origin header", "required": true}
    ]
  }
}

Risk Quantification¶

FAIR Assessment¶

Factor Analysis of Information Risk with ALE calculation:

{
  "riskAssessment": {
    "scenarioName": "WebSocket Takeover",
    "frequency": {
      "contactFrequency": 100,
      "probabilityOfAction": 0.3,
      "threatEventFrequency": 30
    },
    "loss": {
      "primaryLoss": {"amount": 50000, "currency": "USD"},
      "secondaryLoss": {"amount": 200000, "currency": "USD"}
    }
  }
}

EPSS Integration¶

Exploit Prediction Scoring System data for CVEs:

{
  "epssData": [
    {
      "cve": "CVE-2024-12345",
      "score": 0.85,
      "percentile": 0.97,
      "date": "2026-04-28"
    }
  ]
}

Purple Team¶

Atomic Red Team Mapping¶

Link threats to atomic tests for validation:

{
  "atomicTests": [
    {
      "techniqueId": "T1189",
      "testId": "T1189-1",
      "testName": "Drive-by Compromise",
      "result": "passed",
      "platform": "windows"
    }
  ]
}

Detection Coverage Matrix¶

Track MITRE ATT&CK detection coverage:

{
  "detectionCoverage": {
    "techniques": [
      {
        "techniqueId": "T1189",
        "coverage": "full",
        "detectionMethods": ["Network monitoring", "Browser logs"]
      }
    ]
  }
}

Security Metrics¶

Track detection and response effectiveness:

{
  "metrics": {
    "mttd": {"value": 15, "unit": "minutes"},
    "mttr": {"value": 2, "unit": "hours"},
    "mttc": {"value": 30, "unit": "minutes"},
    "detectionRate": 0.95,
    "falsePositiveRate": 0.05
  }
}

Supply Chain Security¶

SBOM Integration¶

Link threat models to software bills of materials:

{
  "sbom": {
    "format": "cyclonedx",
    "version": "1.5",
    "location": "./sbom.json"
  }
}

VEX Statements¶

Vulnerability Exploitability eXchange for status tracking:

{
  "vexStatements": [
    {
      "vulnerability": "CVE-2024-12345",
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path"
    }
  ]
}

SSVC Vulnerability Prioritization¶

CISA Stakeholder-Specific Vulnerability Categorization:

{
  "ssvc": {
    "exploitation": "active",
    "automatable": "yes",
    "technicalImpact": "total",
    "missionPrevalence": "essential",
    "decision": "act"
  }
}

Attack Path Analysis¶

Graph-based attack surface analysis:

FindAllPaths() — Complete path enumeration with cycle detection
FindShortestPath() — Dijkstra's algorithm for minimal path
FindCriticalPaths() — Highest risk path identification
CalculatePathRisk() — Path-based risk scoring
ReachabilityAnalysis() — Exposure assessment from entry points

New Types¶

Type	Description
`ExploitationGuidance`	Red team exploitation steps and tools
`DefenseGuidance`	Blue team detection rules and IOCs
`RemediationGuidance`	Developer fix patterns and checklists
`IncidentPlaybook`	Structured IR procedures
`FAIRAssessment`	FAIR risk quantification
`EPSSData`	Exploit prediction scoring
`KEVEntry`	CISA KEV catalog entry
`AtomicTestMapping`	Atomic Red Team test reference
`DetectionCoverageMatrix`	ATT&CK coverage tracking
`SecurityMetrics`	MTTD/MTTR/MTTC metrics
`SBOMReference`	SBOM integration
`VEXStatement`	Vulnerability status
`SSVCAssessment`	SSVC prioritization
`AttackGraph`	Graph-based attack surface
`AttackPath`	Path analysis results

Installation¶

Go Library¶

go get github.com/grokify/threat-model-spec@v0.6.0

CLI Tool¶

go install github.com/grokify/threat-model-spec/cmd/tms@v0.6.0

Requirements¶

Go 1.25+
D2 v0.6+ (for SVG rendering)