Threat Libraries

A Tree, Not a List

Each threat library is structured as a hierarchical tree rather than a flat list, mapping threats, motives, and targets to the security standards and frameworks that matter for real assessments: CWEs (Common Weakness Enumeration), CAPECs (Common Attack Pattern Enumeration and Classification), CVEs (Common Vulnerabilities and Exposures), MITRE ATT&CK post-exploitation patterns and their mitigations, and OWASP ASVS controls.

That structure is what lets a threat surfaced in a PASTA-based model trace directly back to the standards your security and compliance teams already work from, instead of existing as an isolated finding.

Industry-Focused Libraries

Fifteen industry libraries are available today, each maintained as its own file and open to community contribution. Every library maps its industry's threat landscape back to CWEs, CAPECs, CVEs, MITRE ATT&CK patterns, and OWASP ASVS controls.

Automotive

Threats to connected vehicle systems, telematics, and in-vehicle networks, including risks from over-the-air updates and third-party components.

Consumer Electronics

Threats to connected consumer devices and their supporting cloud services, including firmware integrity and data privacy risks.

Energy

Threats to energy production, distribution, and grid operations, including risks to operational technology (OT) and industrial control systems.

Financial Services

Threats to core banking and financial infrastructure, including fraud, unauthorized transactions, and data exfiltration.

Fintech & Credit Cards

Threats relevant to payment processing and card data environments — the kind of application-layer risk that falls within PCI DSS scope.

Government

Threats facing public-sector systems and critical infrastructure, including nation-state and advanced persistent threat scenarios.

Healthcare

Threats to patient data confidentiality, medical device integrity, and clinical systems availability across hospitals, providers, and other medical organizations.

Higher Education

Threats to research data, student records, and the open network environments common to university systems.

Hospitality

Threats to guest data, payment systems, and property management platforms across hotels and hospitality operators.

Insurance

Threats to policyholder data, claims systems, and underwriting platforms.

Manufacturing

Threats to industrial control systems, supply chain integrity, and intellectual property across manufacturing environments.

Retail

Threats to point-of-sale systems, e-commerce platforms, and customer payment data.

Shipping

Threats to logistics platforms, tracking systems, and supply chain visibility tools.

Telecommunications

Threats to network infrastructure, subscriber data, and telecom-specific attack patterns.

Transportation

Threats to fleet management, routing systems, and transportation infrastructure.

Where This Fits Alongside Compliance

These libraries aren't a substitute for a formal compliance assessment, but they give teams a starting point for the application-layer risks a compliance program needs to account for. That's most direct in industries under regulatory scrutiny — payment card data in the Fintech & Credit Cards library sits close to PCI DSS scope, protected health information in the Healthcare library overlaps with HIPAA concerns, and the kind of structured, evidence-based risk analysis Fork produces is the same category of work that underpins a SOC 2 readiness effort.

Technology-Focused Libraries

Alongside industry libraries, Fork maintains libraries built around specific technologies rather than verticals. This category is newer and actively growing — it currently includes an AI threat library, added in the last few months, with more technology areas planned.

Open Source, Peer-Reviewed, Continuously Updated

Every library lives as a JSON file in the Fork Community repository on GitHub, released under the MIT license. Anyone can propose changes through a pull request; contributions that pass peer review are folded into Fork's threat modeling platform with each new release, so the libraries powering your threat models stay current as the community adds to them.

See Where This Fits

These libraries feed directly into Fork's PASTA-based threat modeling workflow. Read more about the platform's features, or see how Fork compares to other threat modeling tools.