OWASP Cornucopia Mobile App Edition v2.0 ships 80 threats aligned to MASVS v2.1

OWASP has released version 2.0 of its Cornucopia Mobile App Edition, a card game used to run threat modeling sessions for mobile applications. According to the announcement on dev.to, dated 10 September, the new edition is compatible with MASVS v2.1, MASTG v2.0 and MASWE v1.0, and carries 80 threats that together cover the requirements, tests and weaknesses defined by the OWASP Mobile Application Security Project. The same announcement also appeared on dev.to under author Johan Sydseter's account.

What changed in v2.0

The deck is built from six suits of 13 cards plus two jokers, with suit names taken from MASVS categories: Platform & Code (PC), Authentication & Authorization (AA), Network & Storage (NS), Resilience (RS), Cryptography (CRM) and Cornucopia (CM). The Cornucopia suit holds threats tied to MASVS privacy requirements along with newly added cards covering mobile malware.

Every card ships with a mapping table linking it to relevant CAPEC entries, MASWE weaknesses, MASTG best practices, MASTG knowledge base articles, MASTG tests and MASVS requirements. That means a threat picked up during a game session can be translated directly into concrete security requirements. The edition is published in English and has been translated into Hindi, Russian and Ukrainian, and it can be played online through the OWASP Cornucopia site.

How teams use it

The announcement includes a field report from Admincontrol, which runs Cornucopia sessions before building mobile apps and features. Playing the game surfaces threats during the design phase, and the mapping tables let the team settle security requirements within a development sprint instead of bolting them on afterwards. Because the team itself decides which threats matter and how to handle them, the post argues, the exercise builds security awareness without the friction that often pushes security work into a backlog and out of sight.

A companion deck for AI-era threats

Alongside the mobile update, OWASP has published a Cornucopia Companion Edition v1.0 with six additional suits: Agentic AI (AAI), Automated Threats (BOT), Cloud (CLD), Frontend (FRE), Large Language Models (LLM) and DevOps (DVO). A companion suit can replace or extend suits in the Mobile App Edition, so a team building an LLM-powered mobile app could combine the mobile deck with the LLM suite for a focused session.

The LLM and Agentic AI cards now include mappings to PHANTOM-B, a mnemonic for eliciting LLM-specific threats created by Adam Shostack and Shostack + Associates and described in the post as a STRIDE-analogous tool. The post also states that Cornucopia is now fully synced with AISVS v1.0, the OWASP Artificial Intelligence Security Verification Standard, connecting the threat discovery phase of a session to verifiable requirements.

Availability

Beyond the online version, a physical Companion Edition can be purchased through CyberSec Games as part of a 25th Anniversary box that also includes the Website App Edition 3.0. A physical Mobile App Edition v2.0 may open for pre-order soon, according to the announcement.

Why it matters

Threat modeling only pays off when it happens early and produces output developers can act on. By realigning Cornucopia to the current MASVS v2.1, MASTG v2.0 and MASWE v1.0 documents, OWASP closes the gap between a workshop exercise and the standards mobile security teams actually verify against, since each card maps to tests and requirements that can go straight into backlog items.

The release also lands amid a debate about how much security work can be delegated to AI. The announcement is blunt on this point: it argues that AI agents tend to agree with whatever direction a team is already heading, and that engineers still need their own grasp of which threats matter before they can judge an AI-generated answer. With companion suits for LLMs, agentic AI, cloud and automated threats, Cornucopia now offers a structured way to reason about the same AI-driven systems teams are shipping, while keeping the decisions with the people responsible for the consequences.