> For the complete documentation index, see [llms.txt](https://docs.devarmor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devarmor.com/modules/threat-modeler/review-threat-model-output.md).

# Review Threat Model Output

Review and approve threats, risks, controls, and other threat model outputs.

Once the threat model is generated, you can review the threats, risks, and mitigation plans (including controls) that DevArmor has suggested.

In the "Output" step, you can make any changes to the threat model output.

## Threats

Every identified threat is categorized using the industry-standard **STRIDE** framework: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

Threats also show related **MITRE ATT\&CK** techniques and tactics for deeper context, and indicate which architecture components they affect.

## Risks

Each threat is associated with one or more risks — the business impact of the threat being realized. Risk scores and severity levels are calculated consistently using a defined formula, so risk ranking is comparable across threat models.

## Controls

Controls are the mitigations that address a risk. A control can be mapped to multiple relevant compliance requirements — browse the complete list of supported compliance controls and frameworks when mapping a control, not just ones already in use.

## Comparing versions

Use the Version Diff view to compare two versions of a threat model side-by-side and see exactly which threats, controls, and risks changed. See [Threat Model Versions](/modules/threat-modeler/threat-model-versions.md).

Once you've reviewed and approved output, move on to [Implement Threat Model Results](/modules/threat-modeler/implement-threat-model-results.md).