Threat-model an AI system in ten minutes, not ten meetings.
Pick your industry, switch the architectural components you actually run on or off, and get a full STRIDE threat register for every trust boundary that results — mapped to the OWASP Agentic AI, LLM, MCP and AppSec Top 10s, with controls for each. Edit anything, add your own threats, rate likelihood and impact, then export the whole thing as a PDF.
Pick the industry
Changes the impact weighting and the context in the report — the threats themselves stay the same.
Switch components on or off
Click a node to include or exclude it. Trust boundaries — and their threats — appear only when both ends are in scope. Click a boundary label to jump to its threats.
Review and edit the threat register
Everything is editable: rename, rewrite the scenario, re-rate likelihood and impact, set a status and owner, edit controls, or untick a threat to drop it from the model and the PDF.
Risk picture
Live view of the included threats: where they sit on likelihood × impact, how they spread across STRIDE, and which framework entries they map to.
Cells show the number of included threats at that rating. Hover for the list.
- T01Direct prompt injection from an external user20
- T18Tool parameter manipulation20
- T24Confused deputy — tool acts beyond the user's rights20
- T14Agent goal hijack via context or retrieved content16
- T16Unsafe handling of model output16
- T19Excessive agency — tools the task never needed16
| STRIDE | Threats in scope | OWASP Agentic AI | OWASP LLM Top 10 | OWASP MCP Top 10 | OWASP AppSec Top 10 |
|---|---|---|---|---|---|
| S Spoofing 6 threats | Session token theft or replay; Cross-origin abuse of an authenticated session; Session fixation across the anonymous-to-authenticated transition; Loss or spoofing of identity context during forwarding; Social engineering of operators through the agent; Sub-agent impersonation and unauthenticated agent messages | ASI03ASI07ASI09ASI10 | LLM06 | — | A01A02A04A07 |
| T Tampering 15 threats | Direct prompt injection from an external user; Malformed request and client-side injection (XSS / CRLF); Token forgery or claim manipulation; Request tampering and replay inside the trusted zone; Agent goal hijack via context or retrieved content; Unsafe handling of model output … +9 | ASI01ASI02ASI03ASI04ASI05ASI06ASI07ASI08ASI09 | LLM01LLM03LLM04LLM05LLM06LLM07LLM08LLM09 | MCP03MCP04MCP05MCP06 | A03A04A05A06A07A08 |
| R Repudiation 3 threats | Hallucinated or misleading answers acted upon; Missing audit trail for agent decisions and actions; No AI-specific detection or incident playbooks | ASI08ASI09ASI10 | LLM09 | MCP08 | A09 |
| I Information Disclosure 12 threats | System prompt and guardrail disclosure; Sensitive data sent to the model provider; Over-exposure of data returned by APIs; Standing credentials and secret exposure in the tool layer; Conversation hijacking and cross-user context leakage; Session resurrection after logout and retention violations … +6 | ASI01ASI03ASI06ASI07 | LLM02LLM03LLM07LLM08 | MCP01MCP10 | A01A02A04 |
| D Denial of Service 6 threats | Bot abuse and automated scripting of the assistant; Denial-of-wallet through model token consumption; Recursive tool loops and cascading failures; Cascading failure across an agent chain; Provider outage or silent model change; Expired certificates or failed key rotation | ASI08 | LLM03LLM10 | — | A02A04A10 |
| E Elevation of Privilege 8 threats | Authentication bypass via unauthenticated workflow paths; Gateway bypass — direct access to the runtime; Excessive agency — tools the task never needed; Tool enumeration and invocation of deprecated or hidden tools; Unexpected code execution through a tool; Confused deputy — tool acts beyond the user's rights … +2 | ASI02ASI03ASI05 | LLM05LLM06LLM08 | MCP02MCP05MCP07MCP09 | A01A02A04 |
Questions people ask
Is this a real threat model or just a checklist?
It is a real threat model in the STRIDE-per-trust-boundary style: threats are attached to the specific boundary they cross (for example "agent runtime to tool-execution layer"), each with an attack scenario, a likelihood × impact rating and controls. What makes it reusable is that the catalogue is vendor- and company-neutral, so you tailor it by scoping components and editing, rather than starting from a blank page.
Which frameworks does it map to?
Every catalogued threat is cross-referenced to the OWASP Top 10 for Agentic Applications (2026, ASI01–ASI10), the OWASP Top 10 for LLM Applications (2025, LLM01–LLM10), the OWASP MCP Top 10 (2025, MCP01–MCP10) and the OWASP Top 10 for web applications (2025, A01–A10). The risk-picture section aggregates these into a STRIDE × framework matrix, and the PDF includes the same matrix.
How is risk scored?
Likelihood and impact are each rated 1–5 and multiplied (maximum 25). Bands are Low 1–4, Medium 5–9, High 10–15 and Critical 16–25. Choosing an industry profile raises impact by one point (capped at 5) for threats that touch the data or outcomes that sector is most exposed on — for example personal data in healthcare or fraud in financial services. Any rating you set by hand overrides the default.
Does my architecture or threat model get uploaded anywhere?
No. The tool runs entirely in your browser. The model is autosaved to your browser's local storage, and the PDF and JSON exports are generated on your device. Nothing is sent to a server.
Can I use this for a chatbot, a copilot or a RAG search?
Yes — the ten components cover all three. A RAG search would keep the knowledge index and ingestion boundaries in scope; a copilot with write access would keep the tool-execution layer and enterprise APIs; a simple assistant might switch off RAG and human handoff entirely. The register adapts to whatever you leave switched on.