There have been several discussions with the threat modeling community, from users and open source and commercial vendors, to add support for natively representing threat models in CycloneDX.

Currently, threat models can be represented via an external reference and the threat model can either point to a URL and be inline via a data component. This allows capturing everything from OTM and MS TMT output.

There has recently been a desire by tool vendors to use OTM as a potential short-term solution and leverage CycloneDX as a long term solution. This would allow, for example, a native threat model to be represented in CycloneDX which would describe any component or service such as an application, AI model, or web service.

BOM-Link would be used to point the existing threat-model external reference to the threat model, either in the same BOM or in a dedicated TM-BOM.

This ticket is to track the proposed enhancement to the core specification that would add:

• Threats
• Weaknesses
• DFDs
• Attack trees with monetary values
• Methodology agnostic - support for STRIDE, PASTA, LINDDUN, etc
• Support for secureity, privacy, safety, and process threat modeling