Name: threat-mitigation-mapping
Author: wshobson

Imported from wshobson/agents (plugins/security-scanning/skills/threat-mitigation-mapping/SKILL.md) via skills.sh. Install upstream with npx skills add wshobson/agents --skill threat-mitigation-mapping. Copyright stays with the author.

Threat Mitigation Mapping

Connect threats to controls for effective security planning.

When to Use This Skill

Prioritizing security investments
Creating remediation roadmaps
Validating control coverage
Designing defense-in-depth
Security architecture review
Risk treatment planning

Core Concepts

1. Control Categories

Preventive ────► Stop attacks before they occur
   │              (Firewall, Input validation)
   │
Detective ─────► Identify attacks in progress
   │              (IDS, Log monitoring)
   │
Corrective ────► Respond and recover from attacks
                  (Incident response, Backup restore)

2. Control Layers

Layer	Examples
Network	Firewall, WAF, DDoS protection
Application	Input validation, authentication
Data	Encryption, access controls
Endpoint	EDR, patch management
Process	Security training, incident response

3. Defense in Depth

                    ┌──────────────────────┐
                    │      Perimeter       │ ← Firewall, WAF
                    │   ┌──────────────┐   │
                    │   │   Network    │   │ ← Segmentation, IDS
                    │   │  ┌────────┐  │   │
                    │   │  │  Host  │  │   │ ← EDR, Hardening
                    │   │  │ ┌────┐ │  │   │
                    │   │  │ │App │ │  │   │ ← Auth, Validation
                    │   │  │ │Data│ │  │   │ ← Encryption
                    │   │  │ └────┘ │  │   │
                    │   │  └────────┘  │   │
                    │   └──────────────┘   │
                    └──────────────────────┘

Templates and detailed worked examples

Full template library and detailed mitigation/control mappings live in references/details.md. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.

Best Practices

Do's

Map all threats - No threat should be unmapped
Layer controls - Defense in depth is essential
Mix control types - Preventive, detective, corrective
Track effectiveness - Measure and improve
Review regularly - Controls degrade over time

Don'ts

Don't rely on single controls - Single points of failure
Don't ignore cost - ROI matters
Don't skip testing - Untested controls may fail
Don't set and forget - Continuous improvement
Don't ignore people/process - Technology alone isn't enough

Install threat-mitigation-mapping and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "wshobson-agents-threat-mitigation-mapping", "kind": "skill", "name": "threat-mitigation-mapping", "description": "Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.", "publisher": "wshobson", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/wshobson/agents", "path": "plugins/security-scanning/skills/threat-mitigation-mapping/SKILL.md", "ref": "HEAD", "url": "https://www.skills.sh/wshobson/agents/threat-mitigation-mapping", "key": "wshobson/agents/plugins/security-scanning/skills/threat-mitigation-mapping/SKILL.md" } }, "instructions": "# Threat Mitigation Mapping\n\nConnect threats to controls for effective security planning.\n\n## When to Use This Skill\n\n- Prioritizing security investments\n- Creating remediation roadmaps\n- Validating control coverage\n- Designing defense-in-depth\n- Security architecture review\n- Risk treatment planning\n\n## Core Concepts\n\n### 1. Control Categories\n\n```\nPreventive ────► Stop attacks before they occur\n │ (Firewall, Input validation)\n │\nDetective ─────► Identify attacks in progress\n │ (IDS, Log monitoring)\n │\nCorrective ────► Respond and recover from attacks\n ", "cost": { "context_tokens": 682 } }

threat-mitigation-mapping

About