A computing system implemented method for automating threat model generation for an application (112, 113, 115) of an asset (111, 114) of a service provider, comprising: identifying, with a first computing environment, components of the application, wherein the components receive, transfer, and transmit information for the application, wherein the asset is included in a second computing environment provided by the service provider and configured to make the application publically available through one or more networks; receiving security information, for at least some of the components, that identifies whether measures were taken within the application to secure the application against a list of security threats, wherein the first computing environment maintains the list of security threats within a threat model database; determining whether the measures sufficiently address security risks associated with the list of security threats, including: transmitting first queries to a third computing environment that are related to the security information, wherein the third computing environment is a different computing environment than the first and second computing environments; receiving responses from the third computing environment to the first queries related to the security information; transmitting subsequent queries to the third computing environment in response to and based at least in part on content of the responses to the first queries; and providing a threat model to the third computing environment, the threat model including a report that identifies components of the application that have been sufficiently secured, and identifies components of the application that have been insufficiently secured, from each of the list of security threats, as determined by the first computing environment, wherein the first computing component is aimed at ensuring that applications hosted by assets within the second computing environment satisfy one or more conditions that are determined or set forth by the service provider. identifying, with a first computing environment, components of the application, wherein the components receive, transfer, and transmit information for the application, wherein the asset is included in a second computing environment provided by the service provider and configured to make the application publically available through one or more networks; wherein the components receive, transfer, and transmit information for the application, wherein the asset is included in a second computing environment provided by the service provider and configured to make the application publically available through one or more networks; receiving security information, for at least some of the components, that identifies whether measures were taken within the application to secure the application against a list of security threats, wherein the first computing environment maintains the list of security threats within a threat model database; whether measures were taken within the application to secure the application against a list of security threats, wherein the first computing environment maintains the list of security threats within a threat model database; determining whether the measures sufficiently address security risks associated with the list of security threats, including: transmitting first queries to a third computing environment that are related to the security information, wherein the third computing environment is a different computing environment than the first and second computing environments; receiving responses from the third computing environment to the first queries related to the security information; transmitting subsequent queries to the third computing environment in response to and based at least in part on content of the responses to the first queries; and transmitting first queries to a third computing environment that are related to the security information, wherein the third computing environment is a different computing environment than the first and second computing environments; receiving responses from the third computing environment to the first queries related to the security information; transmitting subsequent queries to the third computing environment in response to and based at least in part on content of the responses to the first queries; and providing a threat model to the third computing environment, the threat model including a report that identifies components of the application that have been sufficiently secured, and identifies components of the application that have been insufficiently secured, from each of the list of security threats, as determined by the first computing environment, wherein the first computing component is aimed at ensuring that applications hosted by assets within the second computing environment satisfy one or more conditions that are determined or set forth by the service provider.