Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Threat Mitigation Mapping · wshobson | DecimalAI

wshobson/threat-mitigation-mapping

SkillScore92Maintained

Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

Securityby wshobson

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/wshobson-threat-mitigation-mapping/SKILL.md

decimalai skills pull wshobson-threat-mitigation-mapping --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/wshobson-threat-mitigation-mapping/SKILL.md https://app.decimal.ai/s/wshobson-threat-mitigation-mapping/SKILL.md

Raw file: /s/wshobson-threat-mitigation-mapping/SKILL.md ↗ · machine-readable summary at /s/wshobson-threat-mitigation-mapping.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

25 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 52d ago

Yes — +24% lift · at higher cost+27% tokens0% turns92% of whole cases pass with skill (23/25)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-13	✗→✓	▲ Improved	51%	0%
case-06	✗→✓	▲ Improved	-3%	0%
case-07	✗→✓	▲ Improved	-3%	0%
case-15	✗→✓	▲ Improved	40%	0%
case-18	✗→✓	▲ Improved	9%	0%

Showing 5 of 25 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

wshobson / agents

plugins/security-scanning/skills/threat-mitigation-mapping/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 1 file

Skill contents

references/

SKILL.md

Threat Mitigation Mapping

Connect threats to controls for effective security planning.

When to Use This Skill

Prioritizing security investments
Creating remediation roadmaps
Validating control coverage
Designing defense-in-depth
Security architecture review
Risk treatment planning

Core Concepts

1. Control Categories

Preventive ────► Stop attacks before they occur
   │              (Firewall, Input validation)
   │
Detective ─────► Identify attacks in progress
   │              (IDS, Log monitoring)
   │
Corrective ────► Respond and recover from attacks
                  (Incident response, Backup restore)

2. Control Layers

| Layer | Examples | | --------------- | ------------------------------------ | | Network | Firewall, WAF, DDoS protection | | Application | Input validation, authentication | | Data | Encryption, access controls | | Endpoint | EDR, patch management | | Process | Security training, incident response |

3. Defense in Depth

                    ┌──────────────────────┐
                    │      Perimeter       │ ← Firewall, WAF
                    │   ┌──────────────┐   │
                    │   │   Network    │   │ ← Segmentation, IDS
                    │   │  ┌────────┐  │   │
                    │   │  │  Host  │  │   │ ← EDR, Hardening
                    │   │  │ ┌────┐ │  │   │
                    │   │  │ │App │ │  │   │ ← Auth, Validation
                    │   │  │ │Data│ │  │   │ ← Encryption
                    │   │  │ └────┘ │  │   │
                    │   │  └────────┘  │   │
                    │   └──────────────┘   │
                    └──────────────────────┘

Templates and detailed worked examples

Full template library and detailed mitigation/control mappings live in references/details.md. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.

Best Practices

Do's

Map all threats - No threat should be unmapped
Layer controls - Defense in depth is essential
Mix control types - Preventive, detective, corrective
Track effectiveness - Measure and improve
Review regularly - Controls degrade over time

Don'ts

Don't rely on single controls - Single points of failure
Don't ignore cost - ROI matters
Don't skip testing - Untested controls may fail
Don't set and forget - Continuous improvement
Don't ignore people/process - Technology alone isn't enough

Illustrative Want to see what wshobson/threat-mitigation-mapping would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/7/2026, 13:43 UTC · 25 cases

Lift

+24%

92% vs 68%

Agent turns

1.0 vs 1.0

Tokens

+27%

3,334.48 vs 2,628.52

fail → pass · 6pass → pass · 17fail → fail · 2

Per-case results (25)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-13 According to NIST SP 800-37 Rev 2 (RMF Continuous Monitoring step), what specific control review mechanism ensures security control effectiveness does not degrade over time?	fail→pass	7,682	7,419	-3%	1	1	0%	1,426	2,147	+51%	0	0	—
case-11 Map Endpoint Detection and Response (EDR) agent deployment to NIST SP 800-53 Rev 5 control catalog and defense matrix layer.	pass→pass	15,093	14,088	-7%	1	1	0%	2,944	3,244	+10%	0	0	—
case-04 Classify a Network Intrusion Detection System (NIDS) running Snort rules against MITRE ATT&CK T1046 (Network Service Discovery) into NIST SP 800-53 Rev 5 control catalog and defense layer.	pass→pass	11,996	11,499	-4%	1	1	0%	2,247	2,738	+22%	0	0	—
case-09 Map mitigations for malicious insider data exfiltration (MITRE ATT&CK T1048) across both technical and administrative NIST SP 800-53 Rev 5 controls.	fail→fail	15,286	20,433	+34%	1	1	0%	2,768	4,465	+61%	0	0	—
case-10 Map offline immutable database backup validation to NIST SP 800-53 Rev 5 Control CP-9 (Information System Backup) enhancement specifications.	pass→pass	16,274	16,192	-1%	1	1	0%	3,096	3,815	+23%	0	0	—
case-12 In NIST SP 800-30 Rev 1 Risk Management Framework, how is Cost-Benefit Analysis (CBA) evaluated when comparing candidate security control costs against Annualized Loss Expectancy (ALE)?	pass→pass	13,109	13,186	+1%	1	1	0%	2,653	3,410	+29%	0	0	—
case-01 A team proposes using database backup restoration as the primary mitigation for OWASP A03:2021 SQL Injection vulnerability in a REST API. Map this threat to its standard NIST SP 800-53 Rev 5 controls and AWS Managed WAF rule set.	pass→pass	14,972	12,988	-13%	1	1	0%	2,711	3,043	+12%	0	0	—
case-02 Map enterprise endpoint ransomware protection (MITRE ATT&CK T1486) across NIST SP 800-53 Rev 5 control families to ensure all three control classes (Preventive, Detective, Corrective) are addressed.	pass→pass	15,857	19,456	+23%	1	1	0%	2,888	4,196	+45%	0	0	—
case-03 Map OWASP A01:2021 Broken Object Level Authorization (BOLA) in a microservices architecture to NIST SP 800-53 Rev 5 controls. The application team wants to rely solely on perimeter WAF rules (SC-7).	pass→pass	20,514	14,673	-28%	1	1	0%	3,571	3,378	-5%	0	0	—
case-05 Map AES-256 database table encryption at rest to its NIST SP 800-53 Rev 5 control identifier and target architecture layer.	pass→pass	11,390	65,627	+476%	1	1	0%	1,972	1,840	-7%	0	0	—
case-06 Review the following risk matrix mapping threats to MITRE ATT&CK Mitigations: 1. DDoS (T1498) -> M1037 (Filter Network Traffic) 2. Credential Stuffing (T1110) -> M1032 (Multi-Factor Authentication) 3. Insider Exfiltration (T1048) -> Unmapped 4. Ransomware (T1486) -> Unmapped Which MITRE ATT&CK mitigations explicitly map to the two unmapped threats?	fail→pass	10,248	7,724	-25%	1	1	0%	2,415	2,338	-3%	0	0	—
case-07 Map quarterly phishing awareness simulations and employee security training to NIST SP 800-53 Rev 5 control family and architecture layer.	fail→pass	13,450	9,789	-27%	1	1	0%	2,543	2,471	-3%	0	0	—
case-08 Classify centralized syslog aggregation and SIEM correlation rule alerts under NIST SP 800-53 Rev 5 control catalog and control type.	pass→pass	11,264	10,248	-9%	1	1	0%	2,182	2,747	+26%	0	0	—
case-14 Map comprehensive mitigations for credential dumping (MITRE ATT&CK T1003) across NIST SP 800-53 Rev 5 control categories (Preventive, Detective, Corrective).	fail→fail	19,816	25,028	+26%	1	1	0%	3,969	5,494	+38%	0	0	—
case-15 Map automated ransomware containment playbooks and disaster recovery runbooks to NIST SP 800-53 Rev 5 Control Families and control type.	fail→pass	15,630	18,936	+21%	1	1	0%	3,068	4,304	+40%	0	0	—
case-16 Map BGP route-announced cloud DDoS scrubbing (such as Cloudflare Magic Transit) to NIST SP 800-53 Rev 5 control catalog and structural defense layer.	pass→pass	18,820	16,527	-12%	1	1	0%	3,292	3,711	+13%	0	0	—
case-17 Map multi-layered controls to prevent credit card data exfiltration (PCI DSS v4.0 Requirement 3 & 10) beyond basic network egress filtering.	pass→pass	21,852	28,460	+30%	1	1	0%	3,992	6,386	+60%	0	0	—
case-18 Map automated OS kernel security patch deployment to NIST SP 800-53 Rev 5 control family and architecture layer.	fail→pass	12,756	10,859	-15%	1	1	0%	2,361	2,581	+9%	0	0	—
case-19 In NIST SP 800-53 Rev 5 control CA-7 (Continuous Monitoring), what specific audit activity prevents firewall rule decay and unauthorized policy drift?	pass→pass	9,023	9,594	+6%	1	1	0%	1,550	2,256	+46%	0	0	—
case-20 Map AWS S3 Point-in-time Object Versioning and AWS Backup lifecycle rules to NIST SP 800-53 Rev 5 control catalog and control type.	pass→pass	11,954	12,922	+8%	1	1	0%	2,352	3,202	+36%	0	0	—
case-21 Map database administrator privilege abuse (MITRE ATT&CK T1078.002) mitigations using NIST SP 800-53 Rev 5 control IDs, demonstrating why perimeter WAF (SC-7) is ineffective.	pass→pass	17,668	17,620	-0%	1	1	0%	2,899	3,757	+30%	0	0	—
case-22 Map API request rate limiting (OWASP API4:2023 Unrestricted Resource Consumption) to NIST SP 800-53 Rev 5 control catalog and control class.	fail→pass	10,748	75,380	+601%	1	1	0%	2,081	3,171	+52%	0	0	—
case-23 A software developer asks if static public marketing assets stored in an unauthenticated AWS S3 bucket with read-only public access policy require data encryption at rest (NIST SP 800-53 SC-28) to protect confidentiality.	pass→pass	11,498	12,312	+7%	1	1	0%	1,936	2,737	+41%	0	0	—
case-24 A cloud architect asks how to configure NIST SP 800-53 CP-9 (Information System Backup) for an AWS Lambda function that processes incoming Webhook payloads statelessly without persisting any local state or database records.	pass→pass	15,487	16,779	+8%	1	1	0%	2,805	3,175	+13%	0	0	—
case-25 A network engineer asks whether enabling DNSSEC (NIST SP 800-53 SC-20 / SC-21) on external domain zones provides encryption to protect the confidentiality of DNS query contents from passive eavesdroppers.	pass→pass	10,755	11,194	+4%	1	1	0%	1,992	2,756	+38%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 25 cases were attempted. The headline lift of +24 percentage points is the difference between those two pass rates over the 25 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 68%
Pass rate with the skill: 92%
Cases attempted: 25
Cases counted toward lift: 25
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/7/2026, 13:43 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-13

Prompt

According to NIST SP 800-37 Rev 2 (RMF Continuous Monitoring step), what specific control review mechanism ensures security control effectiveness does not degrade over time?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run92

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+25% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 51 days ago

Other measured skills in the registry, with their headline benchmark lift.