Many well-established threat modeling approaches utilize graphs as underlying structures. However modifications to these structures or transformations between modelling approaches are often imprecisely specified. In this paper, we propose a graph-transformational approach to threat modeling. In particular, we show an attempt at formalizing a reduction for graphs resulting from a transformation from attack-defense trees to stochastic games. Further, we formalize system vulnerabilities and mitigations in a graph-transformational setting. This leads us to further research questions that we believe are suitable to be answered in the language of graph transformations.