> For the complete documentation index, see [llms.txt](https://docs.devarmor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devarmor.com/modules/threat-modeler/implement-threat-model-results.md).

# Implement Threat Model Results

How to operationalize threat model outputs

At the last step, you can operationalize the threat model outputs. At this step, you can review security requirements, actions, tests, and other tasks that were deemed relevant as a result of the threat modeling.

We group these downstream activities into four groups:

* **Mitigation Actions**: Tasks that need to be performed by security or engineering teams. You can push these directly to your issue tracking platform — pushing to Jira includes a link back to view the task in Jira, and respects your organization's required custom fields and issue types.
* **Automated Tests**: Tests DevArmor can run automatically in GitHub. These act as policies enforced by [Code Review](/modules/code-reviewer.md), and can also be turned into [AI Guardrails](/modules/code-reviewer/ai-guardrails.md) rule files for AI coding assistants.
* **Manual Tests**: Tests that cannot be run automatically and need to be run manually by your team.
* **Penetration Tests**: Scopes that can be pushed to bug bounty programs or penetration testing consultants, each specifying exactly which system component it targets.