4. A method as in claim 1 further comprising the engine testing the threat.
1. A computer-implemented method comprising: an engine receiving a sequence diagram of a system comprising a plurality of entities, and messages between the plurality of entities sent along communications channels; the engine generating from the sequence diagram, an annotated sequence diagram including an annotation of security information comprising a security goal reflecting an environment in which the plurality of entities reside; the engine displaying the annotated sequence diagram; the engine translating the annotated sequence diagram into a model based upon the annotation; the engine identifying a threat based upon the model; and the engine executing on a hardware processor, a computer program stored in a memory to display a rendering of the threat, the rendering comprising a specific sequence diagram execution manifesting violation of the security goal.