Microsoft continues pattern of misusing terms like “threat” that started with “Threat Modeling” and “WSC2E” Security Development Lifecycle: Microsoft continues to misuse terms such as “threat,” “risk,” and “vulnerability” Microsoft’s STRIDE model supposedly outlines “threats” like “Denial of service,” but STRIDE is just an inverted CIA AAA model, where STRIDE elements are attacks, not threats. The authors try to deflect what I expect was criticism of their term misuse in previous books.”]
Source: https://taosecurity.blogspot.com/2007/10/someone-please-explain-threats-to.html