Threat Modeling Using LLMs
summary
Demonstrates that large language models (GPT‑4, Claude 3) can generate usable STRIDE threat tables from C4 container diagrams and mermaid source, producing component names, data flows, threat IDs, STRIDE per-component categories, explanations, suggested mitigations and a risk severity score (often marked High). Shows an end to end workflow using the OpenAI API and a GitHub Action that creates PRs and issue comments. Flags a real limitation: sending business sensitive docs to third parties risks leakage.
AI-written summary · about
chapters (13)
- 0:00Threat modeling with LLMs
- 1:47What is threat modeling
- 7:56Understanding large language models basics
- 10:52Automating threat modeling
- 15:16Demo architecture
- 20:18Building the prompt
- 23:29Prompt components
- 25:55GitHub action
- 27:20Live demo results
- 29:52Risk severity analysis
- 31:18LLM vs security experts
- 32:43Summary
- 34:27Q&A
related talks
39mThreat Modeling Using LLMs
53mThreat Modeling: uncover vulnerabilities without looking at code
47mHarnessing LLMs for Next-Level Security Analysis
22mEmpowering Developers through Threat Modeling Excellence
46mThreat modeling is on the rise
25mThreat Modeling for AI Apps with Attacks as Code
31mThreat Modeling for Kubernetes: Enhancing Security Posture in Complex and Regulat...
32mThreat Modelling in CI/CD environments