Security teams are getting leaner while the agents they secure keep gaining tasks and reach, so when agents fail, they fail at scale. Threat modelling tells you what could go wrong; Fault Tree Analysis, borrowed from safety engineering, works backwards from a single unacceptable Top Event to show the exact chains of failure that get you there and which few controls and tests actually stop it. Using HAL from 2001: A Space Odyssey as the running example, we discuss how pairing threat models and attack trees with FTA turns gut-feel risk into data-driven prioritisation, and helps build agents that fail safely and predictably.
Segment Resources:
- 0:00 - Introduction to OWASP Global AppSec 2026
- 0:30 - Extending Threat Modeling with Safety Engineering
- 0:52 - What Is Fault Tree Analysis?
- 02:35 - Moving Beyond Traditional Risk Management
- 03:59 - Breaking Down Threats into Root Causes
- 04:23 - Understanding AND/OR Gates and Attack Probability
- 05:37 - Applying Fault Tree Analysis to Real-World Vulnerabilities
- 06:19 - Evaluating Attack Paths and Security Controls
- 07:44 - Testing Controls and Identifying Detection Gaps
- 08:13 - Understanding Minimal Cut Sets
- 09:24 - Making Threat Modeling Actionable at Scale
- 10:10 - Using AI to Automate Fault Tree Analysis
- 11:33 - Understanding Probability, CVSS, and EPSS
- 11:52 - Calculating Risk Over Specific Timeframes
- 13:34 - Turning Risk Analysis into Practical Security Controls
- 14:01 - Key Takeaways from Fault Tree Analysis
- 14:11 - Open Source Project and Research Resources
- 14:27 - Closing Remarks
Petra is a technology leader, public speaker and former emergency medicine doctor. After moving from medicine into technology, she progressed from cybersecurity intern to leadership roles including Director of Cyber Security at Jobandtalent and Head of Information Security at Numan. At Glasswall she invented a novel zero-day malware detection mechanism, which led to an approved patent. She now leads Information Security, AI and Internal Technology at Flagstone, bringing together security strategy, AI adoption and governance, and technology operations.
Petra co-leads the OWASP Threat Model Library and contributes to the CycloneDX Threat Model Bill of Materials (TM-BOM), advancing standardisation and automation in threat modelling. As an Advisor at DevArmor, she supports innovation in automated threat modelling and security design. A former competitive volleyball athlete, she thrives in challenging environments and enjoys bringing order to chaos.
