Multi-tenant software
A B2B product serving thousands of customer organisations from shared infrastructure.
- Tenant ID trusted from the request
- Missing org scope on a shared query
- Cross-tenant reads through a background job
Continuous threat modeling
Threat modeling that never goes stale
Always-on, architecture-level threat models that keep pace with every commit, every repo, every change.
✓ 10-minute first model✓ Read-only access✓ Stays current as code changes
Threat model · acme/payments
The problem
Threat models go stale the moment they're written
Architecture changes weekly. Threat models don't. By the next audit or pen test, no one trusts the doc.
threat-model.notionv1.0 · Mar 14, 2026
- Mar 14Threat model writtenDoc
- Apr 02Added Contentful CMSShip
- May 11Refactored auth flowShip
- Jun 18Added agent + MCPShip
- Aug 03Replaced data warehouseShip
- Sep 12Audit asks for current threat modelStale
How it works
From repo to architectural threat model in minutes
Three steps. No consultants, no week-long workshops, no fifty-page documents that no one reads.
1
Connect your repo
GitHub or GitLab in one click. Read-only access. Nothing modified.
2
Oplane maps your architecture
Services, APIs, data flows, agent interactions, third-party integrations. The full picture, not just the code.
3
See what can go wrong
A visual map of your architecture with threats highlighted. Every finding shows what's wrong, why it matters, and how to fix it.
Real-world threats
What architectural threats look like
Three examples of what scanners miss and Oplane catches.
In-product AI assistant
An LLM feature answering questions over customer data.
- Prompt-injected tool calls
- Retrieval that crosses tenant boundaries
- Over-scoped credentials behind the model
Agent-built feature
A team using Claude Code or Cursor to ship an internal tool calling multiple MCP servers.
- Confused-deputy paths
- Unbounded MCP permissions
- Agent-introduced data flows
Scanners find patterns. Oplane understands the system
Different layer, complementary tools. Both matter.
What scanners find
- Unsafe code patterns
- Known CVEs
- Outdated dependencies
- Hardcoded secrets
What Oplane finds
- Missing authorisation
- Access control gaps
- Unprotected data flows
- Architectural blind spots
Audit-ready by default
Continuous threat models are the artifact regulators actually want
A governed program, not a stale snapshot.
FDA
FDA / MDR
Medical device certification.
PCI
PCI DSS
Payment systems.
SOC
SOC 2 / ISO 27001
Organisational security.
DORA
DORA
Financial services.
See what's hiding in your architecture
A 10-minute analysis surfaces architectural risks scanners and audits miss.