Read the TRACE Methodology Specification

TRACE

TRACE is a threat modelling methodology for modern organisations with heterogeneous, decentralized, cloud-first and remote-first operating environments. It is designed for teams that no longer fit traditional perimeter security models and need a zero trust approach across protocols, systems, and organisations.

TRACE was developed at Oak Security through Web3 security work, where high-value assets, distributed authority, off-chain infrastructure, governance, and human operations are tightly coupled. Its applicability is broader: any organisation with fragmented control paths, high-value digital assets, external dependencies, remote teams, and critical human decision points can use TRACE to build a practical threat model.

This repository contains the current working materials for TRACE:

• METHODOLOGY.md - methodology specification and workflow
• article/ - long-form research article draft
• deck/ - editable PPTX and PDF framework note
• assets/logo/ - TRACE logo lockups for dark and bright backgrounds
• assets/header/ - README banner, transparent header illustration candidates, and previews

Notes

• The logo files are native SVG and have transparent backgrounds unless marked as a preview.
• The README banner is a self-contained SVG designed to render clearly in light and dark GitHub themes.
• Transparent header PNGs are retained as article or presentation illustration candidates. Preview files show how they render on white or dark backgrounds.
• The framework deck is included as both editable PowerPoint and exported PDF.

License

Except where otherwise noted, the documentation, articles, diagrams, presentation materials, templates, and visual assets in this repository are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).

Suggested attribution:

TRACE threat modeling methodology, developed by Oak Security, licensed under CC BY 4.0.

The license allows reuse and adaptation with attribution, but it does not grant trademark rights or permission to imply Oak Security endorsement. See LICENSE.md and TRADEMARKS.md.

This repository currently contains methodology documentation and collateral, not software. If software is added later, it should carry its own software license.