Choose one of three approaches. The steps for that option appear below.
Choose an option above. On a phone, swipe the tabs left or right to see all options →
Kiro drafts assets and threats; you check boundaries before drafting threats, then decide every threat's status.
Collect the feature design document
Draft assets and trust boundaries
Check each asset and boundary
Draft threats for the checked
Check threats
Use: You
Have ready: feature design document, for example design for file upload and sharing; remove anything the team is not permitted to share.
Remove anything the team is not permitted to share.
Use: Kiro
Ask Kiro for asset, boundary and crossing-data rows from the design document.
What to paste into the tool
Task: Draft list (Table: asset, boundary, data). Read this design document. List every asset, the trust boundaries it crosses, and the data involved, as a table: asset, boundary, data. Use only what the document states; mark anything the document does not state as unstated.
Use: You
Compare the draft with the design, add missing boundaries, correct mismatches and check the list before requesting threats.
Tie every asset and boundary to a line in the design document. Check the drafted list of assets and trust boundaries against your design document, correct anything that does not match and confirm the list.
Use: Kiro
Ask Kiro for threats per checked boundary, each tied to a named asset, with open questions.
What to paste into the tool
Task: Draft threats per boundary with open questions. For each trust boundary in this table, draft the threats that apply, each naming the asset at risk and the boundary. Add open questions where the design is silent. This is a draft for review, not a security approval.
Use: You
Check each threat names an asset and boundary; remove unsupported threats, record accepted, mitigated or open with a reason, then approve the list.
Each threat names an asset and a trust boundary, and the engineer has marked every threat accepted, mitigated or open. This outline is not a security approval. Delete threats that do not name an asset and a trust boundary.
Perplexity proposes boundaries and cited threat categories; you check sources before threat drafting and decide every threat's status.
Collect design excerpts about data
Draft boundaries and cited threat
Check boundaries and
Draft threats from the checked
Check threats
Use: You
Have ready: feature design document, for example file upload and sharing. Select parts describing data, access and who can reach what.
Use: Perplexity
Ask Perplexity for assets, boundaries, crossing data and documented threat categories per boundary kind with citations.
What to paste into the tool
Task: A proposed asset and trust boundary list with cited threat categories. From the design excerpts pasted here, propose a table of assets and trust boundaries with the data that crosses each. Then, for each kind of boundary, which threat categories does primary documentation describe? Cite sources. Do not assess my system beyond the pasted excerpts. Mark anything not in the excerpts or the cited sources as a question, not a fact.
Use: You
Check against the design, add missing assets or boundaries and open each source to check it supports the cited category.
Use: Perplexity
Ask Perplexity for threats per boundary naming an asset and boundary, with open questions listed separately.
What to paste into the tool
Task: Draft threats per boundary. Using only the checked asset and boundary list and the confirmed threat categories in this chat, draft threats per boundary. Each threat names one asset and one trust boundary from the list. List open questions separately. Do not add assets, boundaries or categories that are not in the list.
Use: You
Check each threat against the design; record accepted, mitigated or open with a reason, then approve the list.
Each threat names an asset and a trust boundary, and the engineer has marked every threat accepted, mitigated or open. This outline is not a security approval.
Notion AI drafts assets, boundaries and threats; you check the design at each gate and decide every threat's status.
Collect the feature design
Draft assets and trust boundaries
Check boundaries against the design
Draft the threat review document
Check threats
Use: You
Have ready: feature design document, for example file upload and sharing; paste it into a Notion AI page.
Use: Notion AI
Ask Notion AI for asset, boundary and crossing-data rows from the document.
What to paste into the tool
Task: List (Table: asset, boundary, data). From the design document on this page, draft the list of assets and trust boundaries with the data that crosses each. Use only what the design document states; where it is silent, leave an open question instead of guessing.
Use: You
Correct mismatches and add missing assets or boundaries before requesting the threat document.
Tie every asset and boundary to a line in the design document. Check the drafted list of assets and trust boundaries against your design document, correct anything that does not match and confirm the list.
Use: Notion AI
Ask Notion AI for threats naming checked assets and boundaries, plus separate open questions where the design is silent.
What to paste into the tool
Task: Draft review document: threats per boundary with open questions. From the design document and the checked asset and boundary table on this page, draft threats per boundary: each threat names an asset and a trust boundary from the table, with open questions where the design is silent. Format it as a review document: the assets and boundaries table, then threats grouped by boundary, then open questions. Use only what the design document and the checked table state; do not invent threats, assets or boundaries.
Use: You
Compare threats with design and checked list; keep formatting from changing checked items. Record accepted, mitigated or open with reasons and approve.
The engineer has marked every threat accepted, mitigated or open. Each threat must name an asset and a trust boundary from the list, and the formatting must not add, drop or reword any checked item.
Best when: You want a design-based outline with a boundary checkpoint.
What it does: Kiro drafts assets and threats; you check and decide statuses
Strong at: Drafts asset and boundary tables before drafting threats per boundary.
Limit: This outline is not a security approval.
Free plan: Yes, monthly credit limits
Best when: You want documented threat categories with sources you can open.
What it does: Perplexity cites categories and drafts; you check and decide statuses
Strong at: Links proposed threat categories to cited sources before drafting threats.
Limit: Every category citation and proposed boundary needs your own check.
Free plan: Yes, limited uploads
Best when: You want the outline and status decisions on one document page.
What it does: Notion AI drafts assets and threats; you check and decide
Strong at: Drafts assets, boundaries and a formatted threat document from page content.
Limit: Paid plan needed; formatting must not change checked content.
Free plan: Paid plan needed
Before you paste into any AI tool, remove any confidential information. Put it back at the end.
Each threat names an asset and a trust boundary.
The engineer marks every threat accepted, mitigated or open with a reason.
The outline stays a draft and is not a security approval.
Check the result against your original inputs. Approve it before sharing or acting.