Dynamic Threat Modeling using Real-Time TTP feeds within DevOps

The traditional threat modeling approaches in software development often occur early in design and remain static, failing to reflect an ever-changing attacker landscape. Modern DevOps pipelines demand continuous, automated security feedback to keep pace with emerging adversary tactics, techniques, and procedures (TTPs). We present DTM-DevOps, a dynamic threat modeling framework that ingests real-time TTP feeds (MITRE ATT&CK via STIX/TAXII), updates service-level threat models, and gates CI/CD pipelines accordingly. In a controlled experiment on a three-service microservices application: DTM-DevOps flagged 28 % more high-risk scenarios than static models. Mean time to threat detection dropped from 5.2 days to 2.1 hours. False-positive rate remained under 12 %. Pipeline runtime overhead averaged 9.5 %. We describe system design, data-processing pipeline, experimental setup, quantitative results, and discuss operational trade-offs.