> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/pentests/coverage-and-findings/threat-model.md).

# Threat Model

The **Threat Model** appears on the assessment detail page once your assessment has started and the discovery phase is finished. It's available for both Aikido Pentest and Code Audit, and provides a transparent, real-time view of how our agents perceive and test your application's security posture.

## Prerequisites

Your code repositories must be linked in the pentest or Code Audit.

## Recon Report

The Recon Report is a high-level summary of what was discovered during the initial discovery phase. It provides a readable overview of your application's **attack surface**, helping you understand the "attacker's view" before reviewing specific exploit attempts.

It gives you a quick view of the application's attack surface, including:

* Endpoints
* Technologies in use
* Authentication mechanisms
* Areas of interest for further testing

Use this report to identify and decommission unnecessary exposed assets or to verify that your intended security controls are visible to the scanner.

This also includes a diagram of your application's architecture, roles, and trust boundaries, so you can see the full picture at a glance.

<div data-with-frame="true"><figure><img src="/files/MvjfXv0XlkNdTD8bp6mW" alt=""><figcaption><p>Example architecture diagram that is included in the recon report</p></figcaption></figure></div>

## Attack Plan

The Attack Plan is a structured table of the specific **attack vectors** for your application. Each row represents a targeted test focused on a specific code snippet or a particular architectural vulnerability hypothesis.

Every entry shows:

* **Starting assumption:** what the agent is testing, plus the targeted file or endpoint
* **Type:** the vulnerability category being tested, such as injection or authentication bypass
* **Agent:** the specific attacker agent assigned to the task
* **Status:** the current state of the attack
  * Not Started - the agent has not begun yet
  * In Progress - the agent is actively running
  * Exploitable - the agent found an exploitable issue
  * No issues found - the agent completed without finding vulnerabilities
  * Stopped - the agent was cancelled


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/pentests/coverage-and-findings/threat-model.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.