A business wants a threat modeling methodology for its cloud platform that starts from business objectives and impact and proceeds through staged analysis, including attack simulation, to risk-based countermeasures. Which methodology fits best?

PASTA, the Process for Attack Simulation and Threat Analysis, is a risk-centric methodology organized into seven stages: defining business objectives, defining the technical scope, decomposing the application, analyzing threats, analyzing vulnerabilities, modeling and simulating attacks, and analyzing risk and impact to select countermeasures. Because it begins from business objectives and ends with business impact, it suits organizations that want threat modeling results expressed in terms executives can weigh against cost. STRIDE is a classification aid that helps engineers enumerate threats per component or data flow by asking which security property could be violated; it is design-centric, lightweight and does not tie threats to business objectives or include attack simulation. DREAD is a scoring model applied after threats are known to rank them; it neither identifies threats nor starts from business context. ATASM moves through architecture, threats, attack surfaces and mitigations to build understanding of a system's structure; it is valuable for architects but is not a staged, business-driven process with simulation. Exam caveat: the methodologies are complementary, and an organization may use STRIDE inside PASTA's threat analysis stage and rate results with a scoring model. Operational check: confirm the chosen methodology's outputs include documented business objectives, simulated attack scenarios and countermeasures traced to risk ratings for the cloud platform.