Elevation of Privilege (Threat Modelling Card Game)

Elevation of Privilege is a threat modelling card game created by Adam Shostack at Microsoft to introduce development teams to this practice. It is based on the six STRIDE categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Participants play around the architecture diagram of their own system and must link each card played to a concrete element of the diagram. The game produces a list of threats to analyse, prioritise, and address.

Walkthrough

1. 1

   Prepare the system for examination

   10 to 20 min

   The facilitator sets up the architecture diagram of the system in the centre of the room or in a shared online space. They ask: "We will only play with what we see here; if a component, flow, or trust boundary is missing, let’s add it now." Participants complete the diagram with the necessary elements for discussion. This step secures the game: threats must always be anchored in a visible element of the system.

   Tip — Before distributing the cards, have participants name the key components and sensitive flows aloud: this prevents the game from drifting towards abstract or out-of-scope threats.

2. 2

   Set the framework and objective

   5 to 10 min

   The facilitator presents the goal: "Our aim is not to prove that the system is bad, but to generate a usable list of threats to address." They remind that the game is designed for 3 to 6 participants and typically lasts 60 to 120 minutes depending on the depth of discussions. Each participant plays with their expertise, without seeking the perfect answer. Disagreements are welcome if they help clarify the threat scenario.

   Tip — Explicitly establish a rule of kindness towards past choices: we critique the risk model, never the individuals or teams who designed the system.

3. 3

   Introduce STRIDE and the colours

   10 min

   The facilitator presents the six families associated with the colours of the game: Spoofing, Identity Spoofing; Tampering, Tampering; Repudiation, Repudiation; Information Disclosure, Information Disclosure; Denial of Service, Denial of Service; Elevation of Privilege, Elevation of Privilege. They clarify that each card invites players to test a threat on the diagram. The Elevation of Privilege colour serves as a trump card in the tricks. Participants can ask for clarification on a category before starting.

   Tip — Keep the translations visible throughout the game, for example on a flip chart: this greatly speeds up contributions from profiles less familiar with STRIDE.

4. 4

   Distribute the cards and explain the mechanics

   5 to 10 min

   The facilitator distributes the official game cards and reminds that the content of the cards comes from the Elevation of Privilege material. They explain: "On your turn, you can play a card if you explain how the described threat applies to a component, flow, or boundary of the diagram. If the link is deemed relevant, we note the threat." The game uses a trick-taking mechanic: players play cards, and the strongest card wins the trick. The Elevation of Privilege colour is the trump.

   Tip — Do not let players read the cards in silence for too long: quickly ask for a first simple example to set the pace and reduce tension.

5. 5

   Play the tricks and qualify the threats

   30 to 70 min

   In each trick, participants take turns playing a card and formulating the associated scenario: "This threat applies here because..." They must point to the relevant element of the diagram and describe the path or situation that makes the threat plausible. If the group acknowledges that the threat applies, the facilitator immediately notes it with the concerned element. The strongest card wins the trick, with Elevation of Privilege as the trump, and a new trick begins.

   Tip — Require a complete threat sentence before noting it: actor or situation, targeted element, feared effect. This transforms a vague intuition into actionable input.

6. 6

   Manage debates and grey areas

   10 to 20 min

   When a card sparks a debate, the facilitator refocuses: "What would we need to know to determine if this threat is real, weak, or already covered?" The group can note the threat as a hypothesis if information is lacking, rather than blocking the game. If a threat is clearly out of scope of the diagram, it is dismissed or placed in a parking lot. The facilitator's role is to maintain the flow of the game while capturing useful learnings.

   Tip — Limit lengthy technical debates by proposing a provisional decision: note the threat, note the hypothesis to verify, then resume the trick.

7. 7

   Consolidate the list of threats

   10 to 20 min

   At the end of the game, the facilitator reads back the produced list and checks that each threat is understandable without the card that triggered it. They ask: "For this line, do we know which element is concerned and what could happen?" Participants merge duplicates, clarify formulations, and indicate threats already covered by an existing control. The expected deliverable is a list of threats to address, not a definitive diagnosis.

   Tip — Rewrite the threats in the present tense and in a concrete manner; a good line should be transferable as is into a backlog or risk register.

8. 8

   Close and decide on next steps

   5 to 10 min

   The facilitator concludes by transforming the output into actions: "Which threats should we analyse first, and who will take it forward?" The group identifies possible next steps: deepening, hypothesis verification, designing mitigation measures, or creating backlog items. The facilitator reminds that the game serves to initiate and structure threat modelling. The session ends when the list has an owner and a clear use.

   Tip — Do not leave the room with just a photo of the board: appoint a consolidation lead and a channel where the list will be shared.

Variants

• Discovery version: the facilitator narrows the scope to a single critical flow or a subsystem. This variant is suitable for teams that are new to STRIDE or have limited time.
• Deepening version: after each noted threat, the group immediately adds any missing information and known existing controls. This slows down the game but better prepares the work of addressing.
• Remote version: use a shared whiteboard for the diagram, a collaborative list for the threats, and a digital support or adapted distribution of the official cards. The facilitator systematically has participants verbalise the pointed element to compensate for the loss of visual attention.
• Multi-profile version: invite developers, operations, product, and security, then ask each player to justify their cards from their business or technical perspective. This variant enriches the scenarios and reveals blind spots between teams.