threat-mitigation-mapping — Claude Code skill
Maps identified threats to security controls and supports remediation planning. Use it when reviewing control coverage or setting security priorities.
/plugin marketplace add wshobson/agents
/plugin install security-scanning@claude-code-workflowsWhat threat-mitigation-mapping does
This skill connects identified threats with suitable security controls and mitigations. It fits security investment planning, remediation roadmaps, control coverage reviews, defense-in-depth design, architecture reviews, and risk treatment planning.
The material separates controls into preventive, detective, and corrective types. It also maps them across network, application, data, endpoint, and process layers. That structure helps expose unmapped threats, avoid relying on a single control, and include testing, cost, and recurring review. Templates and worked mappings are stored in references/details.md.
Install it when you need a structured threat-to-control map or a remediation plan. Skip it for a narrow check of one isolated control.
What it helps with
- map threats to suitable security controls
- prioritize security investments
- build a remediation roadmap
- review control coverage
- design layered defense
Example prompts for the agent
- Map these identified threats to preventive, detective, and corrective controls.
- Review control coverage across the network, application, and data layers.
- Create a remediation roadmap and report critical gaps using the templates in `references/details.md`.
How to install threat-mitigation-mapping
1Plugin marketplace
/plugin marketplace add wshobson/agents/plugin install security-scanning@claude-code-workflowsThis installs the whole security-scanning plugin with all its skills
2Skills CLI (Vercel)
npx skills add wshobson/agents --skill threat-mitigation-mapping -a claude-code3Manually: put the files in place
~/.claude/skills/threat-mitigation-mapping/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/threat-mitigation-mapping/
1Skills CLI (Vercel)
npx skills add wshobson/agents --skill threat-mitigation-mapping -a codex2Manually: put the files in place
.agents/skills/threat-mitigation-mapping/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add wshobson/agents --skill threat-mitigation-mapping -a cursor2Manually: put the files in place
.cursor/skills/threat-mitigation-mapping/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install wshobson/agents threat-mitigation-mapping2Manually: put the files in place
.github/skills/threat-mitigation-mapping/SKILL.mdPlatform CLI
gemini skills install https://github.com/wshobson/agents --path plugins/security-scanning/skills/threat-mitigation-mappingManually: put the files in place
.devin/skills/threat-mitigation-mapping/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set213
The whole set →Similar
Questions about threat-mitigation-mapping
How do I install threat-mitigation-mapping in Claude Code?
Run npx skills add wshobson/agents --skill threat-mitigation-mapping -a claude-code. The skill file is placed at ~/.claude/skills/threat-mitigation-mapping/SKILL.md.
What does threat-mitigation-mapping do?
It maps threats to security controls and mitigations, organizes them by control type and layer, and supports remediation planning and coverage review.
Which platforms support threat-mitigation-mapping?
The skill is listed for Claude Code, Codex, and Cursor. Detailed templates and worked examples are in references/details.md.
Source text
SKILL.md · MIT
---
name: threat-mitigation-mapping
description: Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.
---
# Threat Mitigation Mapping
Connect threats to controls for effective security planning.
## When to Use This Skill
- Prioritizing security investments
- Creating remediation roadmaps
- Validating control coverage
- Designing defense-in-depth
- Security architecture review
- Risk treatment planning
## Core Concepts
### 1. Control Categories
```
Preventive ────► Stop attacks before they occur
│ (Firewall, Input validation)
│
Detective ─────► Identify attacks in progress
│ (IDS, Log monitoring)
│
Corrective ────► Respond and recover from attacks
(Incident response, Backup restore)
```
### 2. Control Layers
| Layer | Examples |
| --------------- | ------------------------------------ |
| **Network** | Firewall, WAF, DDoS protection |
| **Application** | Input validation, authentication |
| **Data** | Encryption, access controls |
| **Endpoint** | EDR, patch management |
| **Process** | Security training, incident response |
### 3. Defense in Depth
```
┌──────────────────────┐
│ Perimeter │ ← Firewall, WAF
│ ┌──────────────┐ │
│ │ Network │ │ ← Segmentation, IDS
│ │ ┌────────┐ │ │
│ │ │ Host │ │ │ ← EDR, Hardening
│ │ │ ┌────┐ │ │ │
│ │ │ │App │ │ │ │ ← Auth, Validation
│ │ │ │Data│ │ │ │ ← Encryption
│ │ │ └────┘ │ │ │
│ │ └────────┘ │ │
│ └──────────────┘ │
└──────────────────────┘
```
## Templates and detailed worked examples
Full template library and detailed mitigation/control mappings live in `references/details.md`. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.
## Best Practices
### Do's
- **Map all threats** - No threat should be unmapped
- **Layer controls** - Defense in depth is essential
- **Mix control types** - Preventive, detective, corrective
- **Track effectiveness** - Measure and improve
- **Review regularly** - Controls degrade over time
### Don'ts
- **Don't rely on single controls** - Single points of failure
- **Don't ignore cost** - ROI matters
- **Don't skip testing** - Untested controls may fail
- **Don't set and forget** - Continuous improvement
- **Don't ignore people/process** - Technology alone isn't enough
© Seth Hobson · MIT · wshobson/agents
