Vallum · Collaborative threat modeling
Pilot programWhat if your business teams helped secure your apps?
Vallum generates your application's data flow diagram from a plain description, lets your whole team identify threats, and gives developers a clear starting point.
Video
Vallum in action.
The problem
Today, threat analysis comes too late
Scattered files.
Spreadsheets, documents and sticky notes: the threat model is never up to date or in one place.
Long, rare workshops.
Bringing experts together takes time, so it rarely happens, and often after development.
Business teams left out.
The people who know business risks best do not take part, for lack of a tool they can use.
How it works
How Vallum works
- Step 1
Describe.
Describe your application in a few sentences, in your own words. Vallum generates the data flow diagram: elements, flows, trust boundaries.
- Step 2
Adjust.
Fix the diagram with drag and drop, like on a whiteboard. Every AI proposal stays pending until a person validates it.
- Step 3
Ask "What if…?".
Business teams ask their questions without jargon: "What if someone changed the transfer amount in transit?". Vallum maps them to a STRIDE threat, with a risk level and proposed measures, which your security experts validate.
- Step 4
Build.
Developers get a clear starting point: threat model, security requirements mapped to OWASP ASVS, and security tests. Optionally, a first code version generated with Claude, proposed as a pull request and never merged without review.
Strengths
What makes Vallum different
- Collaborative
- Business, security and development work on one single model.
- AI-generated diagram
- From a plain-language description to a complete data flow diagram.
- Human validation
- AI proposes, your experts decide, and every decision is recorded.
- One space per application
- Each application has its own project, team, threats and history.
- From model to code
- Requirements, tests and code scaffolding, so security does not stop at the diagram.
- On your servers or in the cloud
- Your threat models stay where you decide.
Who it is for
Who is it for?
CISOs and security teams
Cover more applications while keeping validation and decision traceability.
Leadership and product owners
See where each application stands and build security in from the design stage.
Developers
Know what to secure and how, before writing code.
Business teams
Flag a risk in your own words, without being a cybersecurity expert.
Pilot program
Join our first pilot teams
We are opening Vallum to a small number of teams, to use it on their own applications and shape it with us. We start with a demo on one of your applications.
- A demo on one of your real cases.
- Direct support from the PCYBOX team during the pilot.
- Your feedback directly shapes the next releases.
Application
Become a pilot team
A few details are enough. We will get back to you to set up a demo on one of your applications.
Your information is used only to contact you about Vallum. It is neither sold nor shared. Legal notice and personal data
Frequently asked questions
Your questions about Vallum
Where is our data hosted?
Vallum can be installed on your own servers or used in the cloud. You choose where your threat models stay.
Does the AI decide for us?
No. The AI proposes diagram elements and threats, but nothing is kept without human validation.
Do I need to be a security expert to use it?
No. Business teams ask their questions in plain language, and security experts validate.
What is STRIDE?
A recognized method that sorts threats into six categories: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.
Is generated code deployed automatically?
No. It is proposed as a pull request and never merged without review by your team.
How does a pilot work?
We start with a conversation and a demo on one of your applications, then we define the pilot's scope together.
Security, designed before the first line of code.
Any question? Write to us at contact@pcybox.com
Vallum is a PCYBOX product.