threat model

AI-assisted threat modeling systematically identifies security risks in system design. **STRIDE framework with AI**: AI helps enumerate Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege threats. Analyzes architecture diagrams, data flows, trust boundaries. **Process flow**: Define system scope → Create data flow diagrams → Identify threats per component → Assess risk (likelihood × impact) → Propose mitigations → Prioritize remediation. **AI augmentation**: Generate threat scenarios from architecture docs, suggest attack vectors based on technology stack, identify missing security controls, create threat libraries for common patterns. **Tools**: Microsoft Threat Modeling Tool, OWASP Threat Dragon, IriusRisk with AI features. **Key questions**: What are we building? What can go wrong? What are we doing about it? Did we do a good job? **Output artifacts**: Threat model document, risk register, security requirements, test cases. Regular reviews as architecture evolves keep threat models current and actionable.