Correlate threat models

Last updated: Oct 26, 2026

The Design Map section shows the correlation between your threat model and the vulnerabilities that Fluid Attacks detected in your system. The section shows these threat matches for vulnerabilities with the 'Vulnerable' status and with the 'Safe' status. With this information, you can prioritize the remediation of vulnerabilities. You can start with the vulnerabilities that are the largest risk to your business, as your threat model defines that risk.

Correlate your threat model on the Fluid Attacks platform

See the threat matches

Role required: User, Vulnerability Manager or Group Manager

After you provide an appropriately formatted file, Fluid Attacks processes it in the background. During this process, Design Map shows a message that tells you that Fluid Attacks processes your file.

When Fluid Attacks completes the process, you see one of these:

The Threat Matches table, described below, if Fluid Attacks found one or more correlations.
A message that tells you that Fluid Attacks found no correlatable threats in your file(s).
A message that tells you that Fluid Attacks did not complete the process. If you see this message, upload your file again. If the problem continues, contact us.

The table in Threat Matches shows this information:

Threat: The detailed descriptions of threats to your business, as your model gives them
Correlated weakness: The vulnerabilities from Fluid Attacks' categorization whose descriptions match the descriptions of the threats in your model

The value 'No correlation' means that the threat does not match any of Fluid Attacks' defined categories.
Category: The names of the categories that Fluid Attacks put the weaknesses in
Severity: The default CVSS scores that Fluid Attacks assigned to the related vulnerabilities
Total vulnerabilities: The total number of paths in your system that had the weaknesses

A zero in Total vulnerabilities means that Fluid Attacks has not found vulnerabilities in your system related to the threat in question.
Status: The total number of vulnerabilities for each Status:
- Closed: Vulnerabilities that are no longer present
- Open: Vulnerabilities that are present

Fluid Attacks applies your threat model to the entire group, not to specific components.

Export the threat matches table

Click the Export button next to the Threat Matches table to download its contents as an XLSX file. The file has one row for each threat and the same columns as the table.

How Fluid Attacks uses your threat model files

Fluid Attacks can use the files that you upload to give you Design Map and to improve the features and models of Design Map, as the Fluid Attacks Terms of Use specify.

The function of the models of Fluid Attacks is to classify and correlate threats, not to reproduce the content of your files. Fluid Attacks does not show your content to other clients. The AI providers that help to process your files work with zero data retention terms.

Deleting a file removes it from the platform. Content already used to improve our models is retained for that purpose. Do not include personal data, credentials, or information you are not authorized to share.

Manage threat model files

Role required: User, Vulnerability Manager or Group Manager

Upload your threat model in one or more spreadsheets with the correct format. Fluid Attacks then correlates the model with the reported vulnerabilities. The table in Files shows the name(s), description(s), and upload date(s) of these files.

View threat model files on the Fluid Attacks platform

File: The name of the spreadsheet
Description: The short description that your team wrote for the file
Date uploaded: The date when your team added the spreadsheet to the platform

Upload threat model files

It must be a spreadsheet with .xlsx or .xls extension. Others not supported.
The file must indeed have threat descriptions. If you, for example, add a spreadsheet that only lists security requirements, analysis is not conducted.
Threat descriptions in the spreadsheet must be organized vertically, in the same column(s). Fluid Attacks' analysis takes into account each column with relevant threat descriptions across the sheets in your file. Give the threat-related column an obvious name, such as one including the word "threat."

If your files don't meet the above requirements, Fluid Attacks may not find any correlatable threats. In that case, Threat Matches shows a message indicating that no correlatable threats were found instead of the table described above.

When your threat model spreadsheet has the correct format, follow these steps to add it:

Go to Design Map.
Click the Add/Add file button.
Upload a spreadsheet with the .xlsx or .xls extension. Then, write a short description of the file contents (maximum 200 characters).
Click Continue.

When Fluid Attacks completes the analysis, you can see the results in Threat Matches.

Delete threat model files

When you delete a threat model file, threat matches are recalculated using any remaining file.

To delete threat model files, follow these steps:

Go to Design Map.
In Files, select the checkbox of each file that you want to delete. Then, click the Delete button.
After you delete the file, the Fluid Attacks platform calculates the threat matches again with the other files. Select the checkbox to accept this. Then, click Confirm.

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, complete this contact form.