Threat Modeling
for AI & ML Systems
STRIDE and a classic DFD get you most of the way for the infrastructure around a model -- the API, the storage, the auth. They don't cover prompt injection, training data poisoning, or an agent deciding to call a tool nobody explicitly coded. ThreatTree adds OWASP's LLM and Agentic frameworks and MITRE ATLAS on top, so both layers live in one forest.
AI-specific threats, mapped to ThreatTree
These frameworks were built specifically for the parts of an AI system a classic DFD-plus-STRIDE pass walks straight past.
| What's different about AI systems | In ThreatTree | |
|---|---|---|
| 1 | Model, orchestrator & retrieval architecture The LLM, vector store/RAG pipeline, and any training pipeline feeding it |
Model each as a DFD process or data store, with a trust boundary around the prompt/context window -- the point where user input directly shapes model behavior |
| 2 | Classic infrastructure threats The API, storage, and auth layers around the model |
STRIDE tagging, same as any other DFD element -- this layer hasn't stopped needing it |
| 3 | LLM-intrinsic threats Prompt injection, sensitive information disclosure, supply chain, insecure output handling, unbounded consumption |
Select OWASP Top 10 for LLM Applications as the Threat Framework on any attack tree node |
| 4 | Agentic threats Excessive agency, unsafe tool invocation, goal manipulation for systems that act autonomously |
Select OWASP Top 10 for Agentic Applications alongside or instead of the LLM Top 10, on the same node |
| 5 | Adversary tactics & techniques How an attacker actually executes an AI-specific attack |
A MITRE ATLAS technique field appears automatically alongside the existing MITRE ATT&CK field -- no separate tooling required |
What this is, and isn't: ThreatTree covers the threat modeling and documentation phase for AI systems -- identifying, decomposing, and scoring threats before or alongside development. It doesn't run dynamic prompt-injection tests or red-team a live model; pair it with your adversarial-testing process for that.
One forest, two threat layers
Infrastructure threats and AI-specific threats live on the same architecture, not two disconnected documents.
-
Multi-Framework Threat Tagging
Tag every node with STRIDE, OWASP LLM Top 10, OWASP Agentic Top 10, CAPEC, or MITRE ATT&CK/ATLAS -- see which frameworks your model covers and where the gaps are.
-
Attack Path Decomposition
Break each threat into an Attack Tree with AND/OR logic, from attacker goal to atomic step -- e.g. how an indirect prompt injection in a retrieved document leads to a tool call nobody intended.
-
The Prompt as a Trust Boundary
Draw the context window as its own trust boundary -- anything that ends up in it, from user input to retrieved documents to tool outputs, is treated as the high-privilege surface it actually is.
-
Prioritized Risk Register
Likelihood x Impact scoring generates a ranked risk register automatically across every tree in a forest -- useful evidence for a NIST AI RMF Map/Measure/Manage writeup.
AI & ML threat modeling, answered
What teams building LLM and agentic systems ask before adopting ThreatTree.
Does ThreatTree replace red-teaming or prompt-injection testing?
No. ThreatTree covers the threat modeling and documentation phase -- identifying and scoring threats before you build or ship. It doesn't run dynamic tests against a live model; pair it with your red-team or adversarial-testing process for that.
Does ThreatTree support agentic, tool-calling systems, not just chatbots?
Yes. Alongside OWASP Top 10 for LLM Applications, ThreatTree supports OWASP Top 10 for Agentic Applications as a Threat Framework option on any attack tree node, covering risks like excessive agency and unsafe tool invocation.
Do we need deep ML expertise to use ThreatTree for an AI system?
No. The OWASP LLM/Agentic Top 10 and MITRE ATLAS fields give your team a named framework to work through, the same way STRIDE guides a classic DFD review -- you don't need to invent an AI-specific threat taxonomy from scratch.
Where can I see a worked example?
The blog post linked below walks through a realistic internal support agent -- RAG retrieval, an LLM call, and an autonomous ticket-creation tool call -- threat modeled with STRIDE, OWASP LLM/Agentic Top 10, and MITRE ATLAS together.
Start your AI system threat model in ThreatTree
Free plan available -- no credit card required. Be up and running in minutes.