THREAT MODELING AUTOMATION: OPPORTUNITIES, CHALLENGES, AND THE ROLE OF AI

Summary from the TLDR InfoSec newsletter

Traditional threat modeling struggles with scalability due to needing dedicated security resources as well as engineering resources to understand both the security aspects and application components. Recent innovations in the threat modeling process are meant to integrate threat modeling throughout the SDLC as well as offering tools for diagramming or threat models as code. With the advent of LLMs, it could be possible to generate threat models directly from source code. Current efforts such as STRIDE GPT can generate threat models from a natural language description.