Add Components to Your Product
Components are the building blocks of your security analysis. When you add a component with a specific Component Type, Product Security Hub automatically generates the threat model and recommended security requirements. This is where your architecture becomes a living security document.
Before You Begin
- You have created a product in Product Security Hub
- You have a basic understanding of your product's components (hardware, software, external interfaces)
🔑 Key Concept: Component Types Drive Everything
Each Component Type in Product Security Hub is mapped to a curated library of threats and security requirements based on FDA guidance, industry standards, and real-world attack patterns. When you select a Component Type, you get expert-level security analysis without being a security expert.
Component Type Reference
Use the exact terminology below when adding components to draw.io diagrams in the app. Click on a category to expand and see all component types.
Navigate to the Components Tab
From your product page, click on the Components tab in the navigation bar. This takes you to the Components dashboard where you can add, view, and manage all components in your product.
You'll see the user instruction banner: "Add components based on your design". The dashboard displays a table with columns for ID, Component Name, Component Type, Hardware/Software, and Description.
Add a New Component Manually
Click the + Add a New Component button. A modal will appear with options to define your component.
In the Add Component modal:
- Select a Component Type from the dropdown list. This is the critical field that determines what threats and requirements will be generated.
- Enter a Component Name (optional). If left blank, the component type name will be used. Use a custom name to identify specific instances (e.g., "Main MCU" vs "Sensor MCU").
- Click Add to create the component.
Once added, the component appears in the table with an auto-generated ID (e.g., A.286), the Component Type, Hardware/Software classification, and a default Description. You can click "Add addendum" to add additional notes.
Import Components from Diagram
If you've already built an architecture diagram with Component Types assigned (see Build Your Architecture), you can import those components directly.
To import from a diagram:
- Click the + Add Components from Diagram button
- Product Security Hub scans your diagram for shapes with Component Types
- A review screen appears showing all discovered components
- Review the list and click Save to import
💡 Smart Duplicate Detection
Product Security Hub automatically checks for existing components. If a component already exists in your product, it won't be added again—no duplicates to clean up!
🔄 Two-Way Sync
If you update a component's name on the Components page, that change will be reflected in the data type field on your diagrams. Your architecture stays in sync.
Bulk Import via Excel
Need to add many components at once? Use our Excel template for bulk import.
Bulk import process:
- Download the Excel template from the Components page
- Fill in your components with their types and names
- Import the completed spreadsheet back into Product Security Hub
- All components are created at once with their associated threats and requirements
💡 Tip: Great for migrations
If you have existing component lists in spreadsheets or other systems, the Excel import makes it easy to bring everything into Product Security Hub quickly.
What Happens When You Add a Component
This is where Product Security Hub saves you weeks of work. When you add a component:
Generates Threats
Relevant threats from our catalog are automatically associated with your component based on its type.
Suggests Requirements
Security requirements that address those threats are automatically suggested for your review.
Navigate to the Threats and Requirements tabs to review what Product Security Hub has generated. You can accept, modify, or dismiss these suggestions based on your product's specific context.
🚀 The Power of Component Types
Each Component Type is mapped to a curated library of threats and security requirements based on FDA guidance, industry standards, and real-world attack patterns. You get expert-level security analysis without being a security expert.
Deleting Components
To delete a component, click the trash icon (🗑️) in the component's row on the dashboard.
⚠️ Important: Cascade Delete Warning
When you delete a component, Product Security Hub will warn you that all associated data will also be deleted:
- • Threats linked to this component
- • Requirements addressing those threats
- • Residual Risks associated with the component
- • SBOM entries for the component
- • Vulnerabilities identified for the component
- • Patches tracked for the component
💡 Tip: Review before deleting
Before deleting a component, check the Threats and Requirements tabs to understand what will be removed. If you're unsure, consider marking items as "Not Applicable" instead of deleting.
Best Practices
Be specific with Component Types
Choose the most specific Component Type available. "Hardware - Microcontroller (MCU)" will generate more relevant threats than a generic "Hardware" type.
Use meaningful names
Name components based on their role: "Patient Data Database", "Wireless Communication Module", "Firmware Update Service".
Start with your diagram
Build your architecture diagram first with Component Types, then import. This keeps your visual architecture and component list in sync.
Include external systems
Don't forget to add external systems your product communicates with—cloud services, mobile apps, hospital networks. These interfaces are often attack vectors.
What's Next?
Now that you've added components, explore what Product Security Hub has generated:
- 1 Build Your Architecture View
Create visual diagrams that connect to your components
- 2 Run Your Threat Model
Review threats and assess their applicability to your components
- 3 Manage Security Requirements
Accept or modify auto-generated security requirements
Need help adding components?
We can help you identify the right component types for your product architecture.