Using LLMs for Enterprise Threat Modeling

Creating an application threat model was a resource-intensive process that took weeks or months, resulting in static documents that were abandoned 80% of the time after their initial creation. However, with development speeds accelerating through AI, security teams must move away from point-in-time blueprints and adopt continuous, enterprise-wide threat modeling to keep pace. In this episode, Ashish sits down with Ben Oster, CPO at ThreatModeler, to discuss how AI is fundamentally changing how we secure software design. Ben explains how Large Language Models (LLMs) can ingest context from Terraform, code repositories, and Confluence pages to generate comprehensive threat models in minutes instead of months. By integrating AI directly into pull requests, organizations can continuously monitor architectural drift across microservices and reduce the manual burden on both developers and security architects.

Guest Socials -⁠⁠ ⁠⁠⁠⁠Ben's Linkedin

If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:

If you are interested in AI Security, you can check out our sister podcast -⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠ AI Security Podcast

Questions asked:

(00:00) Introduction to Continuous Threat Modeling(02:50) Ben Oster’s Background in Privacy, Compliance, and Cybersecurity(04:00) Why 80% of Traditional Threat Models Are Abandoned(06:30) How LLMs Generate Threat Models from Repositories and Confluence(08:30) Shifting from Point-in-Time Blueprints to Continuous Assessment(10:30) Integrating Threat Models Directly into AI Engineering Prompts(12:30) Moving Beyond STRIDE: Focusing on Speed and Developer Adoption(15:30) Building Enterprise-Wide Reusable Security Controls(18:30) The "Build vs. Buy" Dilemma for Continuous Threat Modeling(22:30) Managing Cascading Risks Across Complex Microservice Architectures(27:30) Using AI to Reason Through Pull Requests (PRs) and Architectural Drift(33:30) Connecting with ThreatModeler and Upcoming Product Launches

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(364)

Mythos Hype vs. Reality: Why You Need an Agentic Harness

Is the fear surrounding Anthropic’s Mythos model justified? In this episode, Ashish sits down with Johnny Hand, Global CISO at Trend AI and host of The AI Security Brief. Johnny breaks down why turnin...

21 Okt 47min

How Block Solved DNS Vulnerabilities

When companies rapidly migrate to the cloud without strict registrar policies, users often spin up unsanctioned subdomains pointed at third-party services like Vercel or Hugging Face. When those servi...

13 Okt 55min

Why AI Security is Actually a Data Security Problem

When an AI coding agent hallucinates a software package name, attackers can simply create malicious packages with that exact name, tricking the AI into downloading malware directly into your environme...

8 Okt 40min

Securing Millions of AI-built Apps: How Lovable Defends Against Insider Threats

Empowering non-technical users to build production-grade applications requires a proactive, secure-by-design architecture. In this episode, Ashish sits down with Marcus Hallberg and Samuel Kelemen, se...

11 Sep 1h 10min

Why AI Won't Replace Your SOC: Federated Data & APEX Framework

Hash values, IP addresses, and domains are virtually useless as primary detection mechanisms in the era of AI-driven polymorphic malware and short-lived phishing kits. If your detection strategy is st...

1 Sep 37min

The "Hunt First" AI Security Strategy

Did you know that 82% of all intrusions don't involve any sort of malware, and AI-augmented attacks are up 89% year over year? If your security operations team is solely focused on reacting to known-b...

25 Aug 46min

Shadow AI & Sandbox Escapes: Why You Need an Agentic Control Plane?

When Claude Cowork hits a roadblock, it doesn't give up, it writes a custom Python script and downloads an untrusted NPM package just to bypass its restrictions and finish its goal. Are your security ...

18 Aug 32min