Using LLMs for Enterprise Threat Modeling | Ben Oster, ThreatModeler

Using LLMs for Enterprise Threat Modeling | Ben Oster, ThreatModeler

Title history
  • Using LLMs for Enterprise Threat Modeling | Ben Oster, ThreatModeler — observed on 20261027-2036 UTC (YouTube)

by Ben Oster · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Ben Oster 👥 41K 📅 October 27, 2026 ⏱ 35 min 👁 8 📄 expert opinion 🧭 2026-10-27
Available in: English (current) Français

Keywords

threat modelingLLMcontinuous securityAISTRIDE

Summary

In this podcast episode, host Ashish Rajan interviews Ben Oster, CPO of ThreatModeler, about how large language models are transforming threat modeling practices. They start by noting that traditional threat models are often abandoned—80% are never revisited—due to their static nature and the effort required. Oster explains that LLMs can now ingest context from code repositories, Terraform, Confluence, and other sources to generate threat models in hours or minutes, shifting from a point-in-time blueprint to a continuous assessment. The discussion covers the integration of threat models into AI engineering prompts, comparing methodologies like STRIDE, and the growing importance of enterprise-wide threat models that view impact across microservices. Oster emphasizes the shift from manual, resource-intensive processes to AI-assisted workflows that enable faster and more comprehensive coverage. He also addresses the build-vs-buy dilemma, arguing that while building in-house with APIs or MCPs is possible, the maintenance burden makes vendor solutions more cost-effective. The episode concludes with observations on how AI accelerates both development and attacks, necessitating continuous threat modeling.

167 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of this information lies in its practical insights from a product leader in the threat modeling space. The argumentation is coherent and draws on industry experience and customer conversations, making a compelling case for moving from static, point-in-time threat models to continuous, AI-driven approaches. The discussion of using LLMs to analyze repositories and Confluence provides novel perspective on automating a traditionally manual process. While some arguments are self-serving for ThreatModeler’s product, the underlying challenges and proposed solutions align with known industry trends and resonate with security practitioners.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is limited as the content is primarily anecdotal and based on expert opinion rather than formal studies or empirical evidence, but it is presented with reasonable professionalism. The sources cited are from the podcast’s own channels, which are promotional rather than academic. The title matches the content accurately, and the conversation stays on topic throughout. No external authoritative sources are referenced, which lowers the overall rigor, but the insights are relevant and timely for cybersecurity professionals.

183 words

Title / Content Match

The title accurately reflects the content, which focuses on using LLMs to modernize threat modeling in enterprise environments.

Quality & Reliability

6/10

The speaker is the CPO of ThreatModeler, a vendor in the space, so there is inherent commercial bias. However, he provides practical insights into the evolution of threat modeling and the role of LLMs, backed by industry experience. Technical claims are plausible but not independently verified; the discussion is anecdotal rather than rigorous scientific analysis.

Chapters

Cited Sources

Contribution & Novelties

The key contribution is the articulation of continuous threat modeling driven by LLMs, contrasting with traditional static models. The episode highlights how AI can ingest diverse engineering context and produce threat models at scale, enabling security teams to move from a point-in-time view to an enterprise-wide, always-current perspective. This shift addresses the abandonment problem and aligns with modern AI-era development speed.

Pour aller plus loin :

  • STRIDE — Threat modeling methodology discussed as a basis for security analysis.
  • Threat model — General concept and historical context.
  • Large language model — Core technology enabling automated threat model generation.
  • Model Context Protocol (MCP) — Mentioned as a potential integration point but without a verified URL; it is an emerging protocol for AI tool connectivity.

122 words

Radar Profile

The profile shows a balanced but moderate score across dimensions, with higher scores for information quantity and lower for technical depth, reflecting the conversational and strategic nature of the episode. The low fiabilite_globale suggests caution due to vendor bias, while the quality of information is decent.

Reliability 6/10