Threat Modeling in Cybersecurity Using AI

Threat modeling has long been a cornerstone of proactive security architecture. Traditionally, it required experienced security engineers to manually map assets, identify attack vectors, and prioritize risks. That process was slow, inconsistent, and heavily dependent on individual expertise. Artificial intelligence is changing that equation entirely, making threat modeling faster, more accurate, and scalable across complex enterprise environments.

This guide walks through how AI is being applied to threat modeling in cybersecurity, with real-world techniques, working code examples, and practical guidance for security teams looking to modernize their approach.

What Is Threat Modeling and Why Does It Matter

Threat modeling is a structured process for identifying security threats, vulnerabilities, and risks within a system before attackers can exploit them. It answers four fundamental questions: what are you building, what can go wrong, what are you doing about it, and did you do a good enough job.

Frameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), PASTA (Process for Attack Simulation and Threat Analysis), and MITRE ATT&CK provide structured methodologies for this work. The challenge has always been applying them at scale.

If your organization handles complex cloud infrastructure, microservices, or rapidly changing codebases, manual threat modeling cannot keep pace. That is where AI integration becomes mission-critical. Redfox Cybersecurity has worked with organizations across industries to implement AI-augmented threat modeling pipelines that close this gap effectively. Explore those capabilities at https://redfoxsec.com/services.

How AI Enhances Traditional Threat Modeling

AI does not replace human judgment in threat modeling. It amplifies it. Machine learning models can parse large volumes of logs, code repositories, network flows, and vulnerability databases simultaneously, surfacing patterns that would take human analysts days or weeks to uncover.

Key AI contributions to threat modeling include:

Automated asset discovery and classification, natural language processing for parsing CVE descriptions and threat intelligence feeds, graph-based analysis to map lateral movement paths, predictive risk scoring using historical breach data, and anomaly detection in behavioral baselines.

AI-Powered Threat Modeling Architecture

A modern AI-driven threat modeling pipeline typically consists of four layers: data ingestion, feature extraction, model inference, and output reporting. Below is a high-level Python skeleton for building such a pipeline.

import json
import openai
import networkx as nx
from sklearn.ensemble import RandomForestClassifier
import numpy as np

# Step 1: Define assets and data flows
system_model = {
   "assets": ["web_app", "api_gateway", "user_db", "admin_panel"],
   "data_flows": [
       {"from": "user", "to": "web_app", "protocol": "HTTPS"},
       {"from": "web_app", "to": "api_gateway", "protocol": "REST"},
       {"from": "api_gateway", "to": "user_db", "protocol": "SQL"},
       {"from": "admin_panel", "to": "user_db", "protocol": "SQL"}
   ],
   "trust_boundaries": ["internet_to_dmz", "dmz_to_internal"]
}

# Step 2: Use LLM to generate STRIDE threats per component
def generate_stride_threats(component: str) -> dict:
   prompt = f"""
   You are a cybersecurity expert. Perform a STRIDE threat analysis for the component: {component}.
   Return a JSON object with keys: Spoofing, Tampering, Repudiation,
   InformationDisclosure, DenialOfService, ElevationOfPrivilege.
   Each key should have a list of specific threat scenarios.
   """
   response = openai.ChatCompletion.create(
       model="gpt-4",
       messages=[{"role": "user", "content": prompt}],
       temperature=0.2
   )
   return json.loads(response.choices[0].message.content)

# Step 3: Build attack graph
def build_attack_graph(model: dict) -> nx.DiGraph:
   G = nx.DiGraph()
   for flow in model["data_flows"]:
       G.add_edge(flow["from"], flow["to"], protocol=flow["protocol"])
   return G

# Step 4: Score risk using a simple ML model (placeholder with dummy training data)
def score_risk(features: list) -> float:
   X_train = np.array([
       [1, 0, 1, 0],
       [0, 1, 1, 1],
       [1, 1, 0, 1],
       [0, 0, 0, 0]
   ])
   y_train = np.array([0.9, 0.75, 0.6, 0.1])
   clf = RandomForestClassifier(n_estimators=50, random_state=42)
   clf.fit(X_train, y_train > 0.5)
   return float(clf.predict_proba([features])[0][1])

# Execute
for asset in system_model["assets"]:
   threats = generate_stride_threats(asset)
   print(f"\n[{asset}] Threats:", json.dumps(threats, indent=2))

attack_graph = build_attack_graph(system_model)
print("\nAttack paths:", list(nx.all_simple_paths(attack_graph, "user", "user_db")))

risk_score = score_risk([1, 0, 1, 1])
print(f"\nRisk Score for sample component: {risk_score:.2f}")


[cta]

This pipeline combines LLM-driven STRIDE analysis with graph-based attack path modeling and ML risk scoring. Each layer adds a different dimension of intelligence to the threat model.

Using MITRE ATT&CK With AI for Threat Enumeration

The MITRE ATT&CK framework is one of the most comprehensive knowledge bases of adversary tactics and techniques. When combined with AI, it becomes a dynamic threat enumeration engine rather than a static reference document.

The following example shows how to query the ATT&CK TAXII server and use an NLP model to match techniques to your system's components.

from taxii2client.v20 import Server
from stix2 import Filter, MemoryStore
import requests
import json

# Connect to MITRE ATT&CK TAXII server
server = Server("https://cti-taxii.mitre.org/taxii/")
api_root = server.api_roots[0]

# Load Enterprise ATT&CK collection
for collection in api_root.collections:
   if "Enterprise" in collection.title:
       tc_source = MemoryStore()
       tc_source.add(collection.get_objects())
       break

# Retrieve all techniques
techniques = tc_source.query([
   Filter("type", "=", "attack-pattern")
])

# Filter techniques relevant to web applications
def filter_by_keyword(techniques, keyword):
   results = []
   for t in techniques:
       if keyword.lower() in t.get("description", "").lower():
           results.append({
               "id": t.get("external_references", [{}])[0].get("external_id"),
               "name": t.get("name"),
               "tactic": [p.get("phase_name") for p in t.get("kill_chain_phases", [])]
           })
   return results

web_threats = filter_by_keyword(techniques, "web application")
print(json.dumps(web_threats[:5], indent=2))


[cta]

Using this approach, security teams can automatically align their system components with known adversary techniques, building threat models that are grounded in real-world attack intelligence rather than hypothetical scenarios.

AI-Driven Attack Graph Generation

Attack graphs visualize how an attacker can chain together individual vulnerabilities to reach a high-value target. Building them manually for large networks is practically impossible. AI makes this tractable.

The following example uses NetworkX to generate an attack graph and identify the highest-risk paths using centrality analysis.

import networkx as nx
import matplotlib.pyplot as plt

# Define nodes (assets/vulnerabilities) and edges (exploitation steps)
G = nx.DiGraph()

nodes = [
   "internet", "web_server", "app_server", "db_server",
   "admin_workstation", "domain_controller", "backup_server"
]

edges = [
   ("internet", "web_server", {"technique": "T1190 - Exploit Public App", "cvss": 9.8}),
   ("web_server", "app_server", {"technique": "T1059 - Command Execution", "cvss": 8.1}),
   ("app_server", "db_server", {"technique": "T1078 - Valid Accounts", "cvss": 7.5}),
   ("app_server", "admin_workstation", {"technique": "T1021 - Remote Services", "cvss": 8.8}),
   ("admin_workstation", "domain_controller", {"technique": "T1003 - Credential Dumping", "cvss": 9.0}),
   ("domain_controller", "backup_server", {"technique": "T1005 - Local Data Staging", "cvss": 6.5}),
   ("db_server", "backup_server", {"technique": "T1048 - Exfiltration", "cvss": 7.2})
]

G.add_nodes_from(nodes)
for src, dst, attrs in edges:
   G.add_edge(src, dst, **attrs)

# Find all attack paths from internet to domain controller
all_paths = list(nx.all_simple_paths(G, "internet", "domain_controller"))
print("Attack paths to Domain Controller:")
for path in all_paths:
   print(" -> ".join(path))

# Compute betweenness centrality to find critical chokepoints
centrality = nx.betweenness_centrality(G)
critical_nodes = sorted(centrality.items(), key=lambda x: x[1], reverse=True)
print("\nCritical Nodes (by betweenness centrality):")
for node, score in critical_nodes:
   print(f"  {node}: {score:.3f}")


[cta]

The betweenness centrality output identifies which nodes serve as the most critical chokepoints in the attack graph. Hardening these nodes provides the highest return on security investment. This is the kind of prioritization insight that AI-augmented threat modeling delivers systematically.

NLP-Based Threat Intelligence Parsing

Threat intelligence reports, security advisories, and CVE descriptions are written in natural language. Extracting structured threat data from these sources manually is time-consuming. NLP models can automate this extraction at scale.

import spacy
import re

nlp = spacy.load("en_core_web_sm")

# Sample CVE description
cve_text = """
CVE-2024-21413: A critical remote code execution vulnerability exists in Microsoft Outlook.
An attacker who successfully exploited this vulnerability could bypass the Office Protected View
and open in editing mode rather than protected mode. Exploitation requires a malicious email
containing a crafted link. CVSS Score: 9.8. Affected products: Microsoft Outlook 2016, 2019,
Microsoft 365 Apps.
"""

doc = nlp(cve_text)

# Extract entities
print("Named Entities:")
for ent in doc.ents:
   print(f"  {ent.text} -> {ent.label_}")

# Extract CVSS score with regex
cvss_match = re.search(r"CVSS Score:\s*([\d.]+)", cve_text)
if cvss_match:
   print(f"\nCVSS Score: {cvss_match.group(1)}")

# Extract affected products
products_match = re.search(r"Affected products:\s*(.+)", cve_text)
if products_match:
   products = [p.strip() for p in products_match.group(1).split(",")]
   print(f"Affected Products: {products}")

# Map to STRIDE category based on keywords
stride_keywords = {
   "Spoofing": ["impersonate", "forge", "fake identity"],
   "Tampering": ["modify", "alter", "tamper", "inject"],
   "Repudiation": ["deny", "repudiate", "log"],
   "InformationDisclosure": ["leak", "expose", "disclose", "bypass"],
   "DenialOfService": ["crash", "exhaust", "flood", "unavailable"],
   "ElevationOfPrivilege": ["escalate", "privilege", "bypass", "admin", "root", "RCE", "code execution"]
}

cve_lower = cve_text.lower()
print("\nSTRIDE Mapping:")
for category, keywords in stride_keywords.items():
   if any(kw.lower() in cve_lower for kw in keywords):
       print(f"  Matched: {category}")


[cta]

By parsing CVE descriptions and threat reports through NLP pipelines, security teams can automatically categorize incoming threat intelligence into STRIDE categories and feed that data directly into their threat models.

Integrating AI Threat Modeling Into CI/CD Pipelines

Threat modeling should not be a one-time exercise conducted at the start of a project. In DevSecOps environments, it must happen continuously as code changes. AI enables this by integrating threat analysis directly into CI/CD pipelines.

The following GitHub Actions workflow demonstrates how to trigger an automated threat model scan on every pull request.

name: AI Threat Model Scan

on:
 pull_request:
   branches: [main, develop]

jobs:
 threat-model:
   runs-on: ubuntu-latest
   steps:
     - name: Checkout code
       uses: actions/checkout@v3

     - name: Set up Python
       uses: actions/setup-python@v4
       with:
         python-version: "3.11"

     - name: Install dependencies
       run: |
         pip install openai pytm bandit semgrep

     - name: Run Bandit SAST scan
       run: |
         bandit -r . -f json -o bandit_results.json || true

     - name: Run Semgrep threat rules
       run: |
         semgrep --config=p/owasp-top-ten --json > semgrep_results.json || true

     - name: Run AI threat model analysis
       env:
         OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       run: |
         python scripts/ai_threat_model.py \
           --bandit bandit_results.json \
           --semgrep semgrep_results.json \
           --output threat_model_report.md

     - name: Upload threat model report
       uses: actions/upload-artifact@v3
       with:
         name: threat-model-report
         path: threat_model_report.md

     - name: Comment PR with summary
       uses: actions/github-script@v6
       with:
         script: |
           const fs = require('fs');
           const report = fs.readFileSync('threat_model_report.md', 'utf8');
           github.rest.issues.createComment({
             issue_number: context.issue.number,
             owner: context.repo.owner,
             repo: context.repo.repo,
             body: report.substring(0, 65000)
           });


[cta]

This workflow runs static analysis with Bandit and Semgrep, then passes those findings to an AI model that synthesizes a threat model report and posts it directly as a pull request comment. Every code change automatically receives a contextualized threat assessment.

For teams looking to implement this kind of continuous threat modeling at scale, Redfox Cybersecurity offers hands-on advisory and implementation services tailored to your DevSecOps maturity level. Visit https://redfoxsec.com/services to learn more.

Behavioral Anomaly Detection as a Threat Modeling Input

Static threat models capture known risks at a point in time. Behavioral anomaly detection adds a dynamic layer by identifying deviations from baseline activity that may indicate an active or emerging threat.

from sklearn.ensemble import IsolationForest
import numpy as np
import pandas as pd

# Simulate network behavior features
# [bytes_sent, bytes_recv, connection_count, unique_ips, failed_logins]
normal_behavior = np.random.normal(loc=[5000, 8000, 120, 15, 2],
                                   scale=[500, 800, 20, 3, 1],
                                   size=(500, 5))

# Inject anomalous behavior (data exfiltration pattern)
anomalies = np.array([
   [85000, 2000, 450, 85, 0],
   [92000, 1500, 500, 90, 1],
   [78000, 3000, 420, 78, 2]
])

X = np.vstack([normal_behavior, anomalies])
labels = np.array([1] * 500 + [-1] * 3)

# Train Isolation Forest
clf = IsolationForest(contamination=0.01, random_state=42)
clf.fit(X)
predictions = clf.predict(X)

# Evaluate
anomaly_indices = np.where(predictions == -1)[0]
print(f"Detected {len(anomaly_indices)} anomalies at indices: {anomaly_indices}")

# Translate anomalies to threat model entries
for idx in anomaly_indices:
   row = X[idx]
   print(f"\nAnomaly at index {idx}:")
   print(f"  Bytes Sent: {row[0]:.0f} (baseline ~5000)")
   print(f"  Unique IPs: {row[3]:.0f} (baseline ~15)")
   print(f"  Potential Threat: Data Exfiltration (MITRE T1048)")
   print(f"  Recommended Action: Isolate host, capture traffic, escalate to SOC")


[cta]

Anomaly detection outputs like these feed directly back into the threat model, updating risk scores and surfacing new attack vectors that may not have been anticipated during initial design. This creates a living threat model that evolves with the environment rather than becoming stale.

If your organization needs help building anomaly detection pipelines that feed into an enterprise threat modeling program, the team at Redfox Cybersecurity brings deep experience across cloud, hybrid, and on-premise architectures. See what is possible at https://redfoxsec.com/services.

Key Takeaways

AI is not a replacement for security expertise in threat modeling. It is a force multiplier. By combining large language models for STRIDE analysis, graph algorithms for attack path mapping, NLP for threat intelligence parsing, and machine learning for anomaly detection, security teams can build threat models that are more comprehensive, more accurate, and continuously updated.

The technical implementations covered in this guide represent the current state of the practice. Organizations that adopt these approaches gain a measurable advantage in identifying and prioritizing risks before attackers can exploit them.

The key principles to carry forward are: automate what can be automated, integrate threat modeling into the development lifecycle rather than treating it as a gate, ground your threat models in real adversary behavior using frameworks like MITRE ATT&CK, and use behavioral data to keep those models current.

Redfox Cybersecurity helps organizations design and deploy AI-augmented threat modeling programs that align with their specific risk profile, compliance requirements, and engineering maturity. Whether you are starting from scratch or looking to scale an existing program, the expertise is available at https://redfoxsec.com/services.