Threat Modeling Using LLMs
summary
Claims that LLMs can perform practical threat modeling by extracting C4/container diagrams, enumerating STRIDE per component, and producing explanations, mitigations and risk severity; demonstrates uses ChatGPT and OpenAI API with GPT‑4 producing threat tables and mitigations; builds and releases a published GitHub action that continuously scans repos and opens PRs/issues; reports LLM output at about security‑champion quality, flags data‑leak risks when sending business‑sensitive docs to third‑party models.
AI-written summary · about
chapters (13)
- 0:00Threat modeling with LLMs
- 1:47What is threat modeling
- 7:56Understanding large language models basics
- 10:52Automating threat modeling
- 15:16Demo architecture
- 20:18Building the prompt
- 23:29Prompt components
- 25:55GitHub action
- 27:20Live demo results
- 29:52Risk severity analysis
- 31:18LLM vs security experts
- 32:43Summary
- 34:27Q&A
related talks
39mThreat Modeling Using LLMs
47mHarnessing LLMs for Next-Level Security Analysis
23mSecurity and auditing tools in Large Language Models (LLM)
40mWhat Does an LLM-Powered Threat Intelligence Program Look Like?
46mThreat modeling is on the rise
25mThreat Modeling for AI Apps with Attacks as Code
46mHow Large Language Models Are Reshaping the Cybersecurity Landscape
29mThreat Modeling Meets Model Training: Web App Security Skills...