threat-mitigation-mapping – Security skill for AI agents

Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

SecuritySKILL.mdClaude Code · Codex · Hermes · DeepSeek

Install the threat-mitigation-mapping skill with one command

Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.

Claude Code

mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/threat-mitigation-mapping-e2ac5.tgz | tar xz -C ~/.claude/skills

Call it in Claude Code: /threat-mitigation-mapping – then describe the task you want done.

Codex

mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/threat-mitigation-mapping-e2ac5.tgz | tar xz -C ~/.codex/skills

Call it in Codex: $threat-mitigation-mapping – then describe the task you want done.

Hermes Agent

mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/threat-mitigation-mapping-e2ac5.tgz | tar xz -C ~/.hermes/skills

Call it in Hermes Agent: /threat-mitigation-mapping – then describe the task you want done.

DeepSeek

mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/threat-mitigation-mapping-e2ac5.tgz | tar xz -C ~/.deepcode/skills

Call it in DeepSeek: /threat-mitigation-mapping – then describe the task you want done.

SKILL.md content

Threat Mitigation Mapping

Connect threats to controls for effective security planning.

When to Use This Skill

Prioritizing security investments
Creating remediation roadmaps
Validating control coverage
Designing defense-in-depth
Security architecture review
Risk treatment planning

Core Concepts

1. Control Categories

Preventive ────► Stop attacks before they occur
   │              (Firewall, Input validation)
   │
Detective ─────► Identify attacks in progress
   │              (IDS, Log monitoring)
   │
Corrective ────► Respond and recover from attacks
                  (Incident response, Backup restore)

2. Control Layers

| Layer | Examples |

| --------------- | ------------------------------------ |

| Network | Firewall, WAF, DDoS protection |

| Application | Input validation, authentication |

| Data | Encryption, access controls |

| Endpoint | EDR, patch management |

| Process | Security training, incident response |

3. Defense in Depth

                    ┌──────────────────────┐
                    │      Perimeter       │ ← Firewall, WAF
                    │   ┌──────────────┐   │
                    │   │   Network    │   │ ← Segmentation, IDS
                    │   │  ┌────────┐  │   │
                    │   │  │  Host  │  │   │ ← EDR, Hardening
                    │   │  │ ┌────┐ │  │   │
                    │   │  │ │App │ │  │   │ ← Auth, Validation
                    │   │  │ │Data│ │  │   │ ← Encryption
                    │   │  │ └────┘ │  │   │
                    │   │  └────────┘  │   │
                    │   └──────────────┘   │
                    └──────────────────────┘

Templates and detailed worked examples

Full template library and detailed mitigation/control mappings live in references/details.md. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.

Best Practices

Do's

Map all threats - No threat should be unmapped
Layer controls - Defense in depth is essential
Mix control types - Preventive, detective, corrective
Track effectiveness - Measure and improve
Review regularly - Controls degrade over time

Don'ts

Don't rely on single controls - Single points of failure
Don't ignore cost - ROI matters
Don't skip testing - Untested controls may fail
Don't set and forget - Continuous improvement
Don't ignore people/process - Technology alone isn't enough

Related skills

qms-audit-expert – ISO 13485 internal audit expertise for medical device QMS. Covers audit planning…
red-team – Use when planning or executing authorized red team engagements, attack path analysis, or…
ethical-hacking-methodology – Master the complete penetration testing lifecycle from reconnaissance through reporting…
unbroker – Remove your info from data-broker sites, by name or phone.
wcag-audit-patterns – Conduct WCAG 2.2 accessibility audits with automated testing, manual verification, and…
rfp-responder – Use when an RFP, RFI, RFQ, security questionnaire, vendor questionnaire, or proposal…
web-pentest – Authorized web pentest: recon, proof-based exploits, report.
file-path-traversal – Identify and exploit file path traversal (directory traversal) vulnerabilities that…

← Browse all skills