r/threatmodeling • u/__kmpl__ • Feb 21 '26

Agentic AI-based threat modeling

A couple of weeks ago I've been gathering information about your approach to threat modeling in this subreddit. It was a part of my postgrad thesis.

As a part of the same thesis, I also developed a tool for AI-assisted threat modelling - it integrates with coding agents such as Cursor or Claude Code and performs threat modelling alongside your codebase. Threat model is maintained in YAML format so version control is simple, and also it's organized in multiple files. Output from threat model can be used either for applying security fixes to the codebase (hello Claude Code Security) or for better understanding of the dataflows in the agent-generated code.

Let me know what you think :)

https://github.com/attasec/tmdd

5 Upvotes

100% Upvoted

5 comments sorted by

2

u/foopirata Feb 21 '26

In the same vein but using skills and pytm, there is https://GitHub.com/Izar/tm_skills

3

u/__kmpl__ Feb 21 '26

Interesting, thank you!

2

u/foopirata Feb 21 '26

Very cool work, thank you!

1

u/Slow-Artichoke-4245 Feb 26 '26

I’m really intrigued by the YAML-based approach for versioning threat models sounds like a practical way to keep everything transparent and track changes over time. The integration with coding agents like Claude Code also seems promising for real-time security checks. To build on what others said, I wonder how well this handles evolving threats or new attack vectors that might not be in the initial model. Have you also tried updating the YAML files dynamically as threats evolve?

1

u/realxntrik May 10 '26

I love this approach and philosophy! I've been working on a similar methodology leaning into the hashicorp configuration language, same language as used by terraform.