{"id":9182,"date":"2026-08-19T08:25:00","date_gmt":"2026-08-19T08:25:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9182"},"modified":"2026-08-19T08:25:00","modified_gmt":"2026-08-19T08:25:00","slug":"cisos-are-struggling-to-threat-model-ai-can-15-minute-sessions-help","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9182","title":{"rendered":"CISOs are struggling to threat-model AI. Can 15-minute sessions help?"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A few weeks ago, on a busy day, threat-modeling expert Adam Shostack opened an email from a client. Someone at that organization had vibe-coded an app and put it to work with customer data. Now, the client wanted to know what risks the tool posed. And what it should do about them.<\/p>\n

They needed answers quickly, so Shostack gave himself 15 minutes to analyze the system.<\/p>\n

Soon, he had \u201ca list of meaningful threats,\u201d including hallucination and bias, problems that STRIDE<\/a>, a widely used application-security threat model framework, would not have shown.<\/p>\n

\u201cI found some interesting stuff that wasn\u2019t obvious to me when I started,\u201d Shostack says.<\/p>\n

During those 15 minutes, he used PHANTOM-B<\/a>, a threat modeling framework he developed. It starts with the standard question \u201cWhat can go wrong?\u201d but applies it specifically to the LLM components of a system.<\/p>\n

Each letter in the name represents a specific threat: Prompt injection, Hallucination, Anthropomorphization, Non-explainability, Training issues, Overreliance (including data quality or \u201cpoison\u201d), Missing security engineering, and Bias.<\/p>\n

The new framework is meant to complement STRIDE, not replace it. Whereas STRIDE applies across the entire application, PHANTOM-B can be used for the components that interact with LLMs.<\/p>\n

The framework is designed to produce useful results quickly, making threat modeling<\/a> less daunting and less costly. And, therefore, more likely to happen.<\/p>\n

\u201cI\u2019m a big fan of: Let\u2019s make it inexpensive to do this work,\u201d says Shostack, who presented PHANTOM-B at Black Hat USA 2026.<\/p>\n

Shostack adds that CISOs and their organizations are caught between two challenges: the pressure to secure AI quickly and the difficulty of applying existing security tools to it.<\/p>\n

\u201cBusinesses need an entry point, which is something that you can fit into a one-hour meeting or a 10-minute conversation with an executive,\u201d he says.<\/p>\n

The need to use tools like PHANTOM-B is becoming more urgent, as companies increasingly rely on AI. \u201cThreat modeling is more important than ever because AI is introducing genuinely new application architectures and novel risks,\u201d says Jeff Williams, founder of OWASP and founder and CTO of Contrast Security.<\/p>\n

Why traditional threat modeling falls short<\/h2>\n

Threat modeling has always been a struggle. Organizations of all sizes struggle to do it consistently<\/a> because it takes time and often can\u2019t keep pace with the number of applications being built and updated. As a result, many companies reserve it for their most critical systems, leaving much of their software without the same scrutiny.<\/p>\n

\u201cAI didn\u2019t break threat modeling. It exposed weaknesses that were already there,\u201d Williams says. The uncomfortable reality, he argues, is that threat modeling has never been standardized or automated enough to scale.<\/p>\n

The hardest part is not naming threats but figuring out which applications work. \u201cTraditionally, we\u2019ve attempted that with surveys, questionnaires, interviews, stale Visio diagrams, and spreadsheets,\u201d Williams says. \u201cThe resulting model is often incomplete before the exercise even begins, and it becomes obsolete as soon as the application changes.\u201d<\/p>\n

Generative and agentic AI amplify those weaknesses, because their behavior is not easy to predict. Conventional software follows rules that engineers can trace from input to output. AI systems interpret natural-language instructions and generate probabilistic responses, so the same request may produce different results. And when agents can access data or call tools, those results can trigger actions elsewhere.<\/p>\n

\u201cTraditional threat modeling was applied to systems that were generally deterministic. The modern generative and agentic AI systems are non-deterministic, so modification of how we view their risk profiles is needed,\u201d says Brian Glas, vice president of consulting services at CODIFIC and one of the project leads for the OWASP Top 10<\/a>.<\/p>\n

This distinction also appears in Microsoft\u2019s AI threat modeling guidance<\/a>, which notes that the boundary between data and commands can blur, creating new attack surfaces and enabling failures to spread across tools, memory, and agents.<\/p>\n

At the same time, faster development cycles are leaving teams with less time to think through how systems should be designed and secured. And complexity also makes it harder to examine threats in isolation. A weakness in a document, for instance, could alter a model\u2019s response and cause an agent or tool to take an unsafe action in another system. OWASP warns that these risks can spread across the entire retrieval-augmented generation pipeline<\/a>.<\/p>\n

\u201cA chaining of threats or weaknesses results in the exploitation of the application,\u201d Glas says.<\/p>\n

The answer to these is to make threat modeling an ongoing practice, a recommendation that is made in NIST\u2019s Artificial Intelligence Risk Management Framework<\/a>.<\/p>\n

But despite a growing body of guidance \u2014 including Shostack\u2019s PHANTOM-B<\/a>, Microsoft\u2019s AI threat modeling recommendations<\/a>, NIST\u2019s Generative AI Profile<\/a>, and OWASP\u2019s Top 10 for LLM Applications<\/a> \u2014 there is still no definitive playbook for threat modeling AI systems.<\/p>\n

\u201cThreat modeling is not a mature practice,\u201d Glas says. \u201cI believe we are still trying to figure this out.\u201d<\/p>\n

Improving threat modeling in the age of AI<\/h2>\n

A 15- or 30-minute threat-modeling exercise sounds deceptively manageable. But how much useful security work can teams really accomplish in such a short time?<\/p>\n

Shostack says a short session is not supposed to be exhaustive. It should, however, identify enough meaningful risks to guide the next decision: Is the risk acceptable, does the system need to change, or is a deeper review required?<\/p>\n

\u201cOne of the things that we\u2019ve learned from the agile world is that when you make the period of work small, you iterate more and faster,\u201d he says. If the first session misses the mark, the team can erase the whiteboard and try again without losing days or weeks of work. \u201cYou make the experiments cheap, and when the experiment is cheap, you can run it repeatedly.\u201d<\/p>\n

The result should be a set of concrete stories about how the system could fail. Those scenarios can help CISOs understand the risks they are accepting and help technical teams choose appropriate controls, which can mean limiting data access, narrowing tool permissions, adding human approval points, or even reconsidering whether an LLM is needed at all.<\/p>\n

PHANTOM-B aims to fill in gaps left by other frameworks. It touches on relevant but sometimes exotic concepts such as anthropomorphization, asking whether users or developers are treating the model as if it understands intent, reasons like a person, or will reliably follow an instruction such as \u201cDo not do X.\u201d That misplaced trust can shape how a system is designed and how much authority it receives.<\/p>\n

Non-explainability raises another problem. If an LLM screens r\u00e9sum\u00e9s, evaluates medical images, or makes business decisions, an organization may need to justify its output. But asking the model to explain itself may produce a plausible-sounding answer rather than an accurate record of how it reached the original result. Because LLMs are probabilistic, rerunning the same request may not reproduce the same output, making investigation and debugging more difficult.<\/p>\n

The \u201cmissing security engineering\u201d prompt is a reminder that adding an LLM does not eliminate conventional software risks. According to Shostack\u2019s white paper<\/a>, it can magnify them, particularly when organizations rush to deploy vibe-coded software that no one fully understands.<\/p>\n

This tool, together with the work from OWASP, NIST, CISA, and others can help teams understand the emerging risk landscape. \u201cThreat modeling is a creative process,\u201d Williams says.<\/p>\n

Mistakes to avoid when threat-modeling AI systems<\/h2>\n

LLM-powered tools may be relatively new, but they are still apps. They use third-party libraries, process untrusted input, handle sensitive data, expose APIs, and depend on identity and authorization controls.<\/p>\n

Focusing heavily on new AI threats while ignoring the basics can leave organizations exposed to preventable vulnerabilities. \u201cThe biggest mistake is forgetting that all the existing risks still apply,\u201d Williams says.<\/p>\n

He advises CISOs not to jump straight to prompt injection or model manipulation while skipping the fundamentals. \u201cThat\u2019s backwards,\u201d Williams says. \u201cTraditional application security has to be the foundation. The novel AI risks are an additional layer on top of it, not a replacement for it.\u201d<\/p>\n

Glas agrees. \u201cDetails have changed; fundamentals of risk have not,\u201d he says. \u201cDon\u2019t throw away the security lessons learned in the last 25 years to chase velocity.\u201d<\/p>\n

Glas also points to another common problem: missing context. Teams may not fully understand how an LLM fits into the broader application, including its access controls, trust boundaries, inputs, and data flows. Without that view, important risks can easily slip through the cracks.<\/p>\n

Trying to catalog every conceivable attack is not the answer, either. \u201cYou can\u2019t possibly track them all,\u201d Glas says. \u201cThe number of possible attacks is almost limitless.\u201d Instead, he recommends starting with the assets that need protection and the preventive and detective controls already in place. From there, teams can model different attack types to uncover weak or missing controls and determine what is needed to reduce risk to an acceptable level.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A few weeks ago, on a busy day, threat-modeling expert Adam Shostack opened an email from a client. Someone at that organization had vibe-coded an app and put it to work with customer data. Now, the client wanted to know what risks the tool posed. And what it should do about them. They needed answers […]<\/p>\n","protected":false},"author":0,"featured_media":9183,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9182","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9182"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9182"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9182\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9183"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}