When should I use this skill?

Use it when prioritizing security investments, creating remediation plans, or validating control effectiveness. It also fits security architecture review, defense in depth design, and risk treatment planning.

What control categories does it use?

It maps threats to preventive controls that stop attacks, detective controls that identify attacks in progress, and corrective controls that respond and recover.

What control layers does it cover?

Network, application, data, endpoint, and process layers. Examples include firewalls and WAFs, input validation and authentication, encryption and access controls, EDR and patch management, and security training.

Threat Mitigation Mapping

SkillSecurity

Threat mitigation mapping is a skill that guides an AI agent to connect identified threats to preventive, detective, and corrective security controls across network, application, data, endpoint, and process layers. It is used when prioritizing security investments, creating remediation plans, or validating control effectiveness. The agent can score control coverage and recommend where security investment is needed.

Connect your AI Use it in a pipeline

Then ask your AI: use the Threat Mitigation Mapping skill

Details

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; Ahel provides instructions and does not run this skill.

No other account needed.

Have a list of identified threats ready to map.

What your AI can do with it

Map identified threats to preventive, detective, and corrective controls
Cover network, application, data, endpoint, and process layers
Apply defense in depth concepts to control design
Score control coverage and surface critical gaps
Produce mitigation models, gap reports, and implementation roadmaps
Recommend where security investment is needed

Getting started

Have a list of identified threats ready to map.
Add the skill to your agent so it can read its instructions and reference file.
Ask the agent to map the threats to controls and produce a mitigation model.
Review the gap report and implementation roadmap the agent returns.

What this skill tells your AI

The instructions your AI receives, as published by wshobson/agents in plugins/security-scanning/skills/threat-mitigation-mapping/SKILL.md and read by Ahel’s review.

Connect threats to controls for effective security planning.

When to Use This Skill

Prioritizing security investments
Creating remediation roadmaps
Validating control coverage
Designing defense-in-depth
Security architecture review
Risk treatment planning

Core Concepts

1. Control Categories

Preventive ────► Stop attacks before they occur
   │              (Firewall, Input validation)
   │
Detective ─────► Identify attacks in progress
   │              (IDS, Log monitoring)
   │
Corrective ────► Respond and recover from attacks
                  (Incident response, Backup restore)

2. Control Layers

Layer	Examples
Network	Firewall, WAF, DDoS protection
Application	Input validation, authentication
Data	Encryption, access controls
Endpoint	EDR, patch management
Process	Security training, incident response

3. Defense in Depth

                    ┌──────────────────────┐
                    │      Perimeter       │ ← Firewall, WAF
                    │   ┌──────────────┐   │
                    │   │   Network    │   │ ← Segmentation, IDS
                    │   │  ┌────────┐  │   │
                    │   │  │  Host  │  │   │ ← EDR, Hardening
                    │   │  │ ┌────┐ │  │   │
                    │   │  │ │App │ │  │   │ ← Auth, Validation
                    │   │  │ │Data│ │  │   │ ← Encryption
                    │   │  │ └────┘ │  │   │
                    │   │  └────────┘  │   │
                    │   └──────────────┘   │
                    └──────────────────────┘

Templates and detailed worked examples

Full template library and detailed mitigation/control mappings live in references/details.md. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.

Best Practices

Do's

Map all threats - No threat should be unmapped
Layer controls - Defense in depth is essential
Mix control types - Preventive, detective, corrective
Track effectiveness - Measure and improve
Review regularly - Controls degrade over time

Don'ts

Don't rely on single controls - Single points of failure
Don't ignore cost - ROI matters
Don't skip testing - Untested controls may fail
Don't set and forget - Continuous improvement
Don't ignore people/process - Technology alone isn't enough

Signals

GitHub stars: 40k
Forks: 4k
Last commit: Oct 2026

Questions

When should I use this skill?: Use it when prioritizing security investments, creating remediation plans, or validating control effectiveness. It also fits security architecture review, defense in depth design, and risk treatment planning.
What control categories does it use?: It maps threats to preventive controls that stop attacks, detective controls that identify attacks in progress, and corrective controls that respond and recover.
What control layers does it cover?: Network, application, data, endpoint, and process layers. Examples include firewalls and WAFs, input validation and authentication, encryption and access controls, EDR and patch management, and security training.

Advanced

Item type: skill
Key: threat-mitigation-mapping
Source: github.com/wshobson/agents

github.com/wshobson/agents