Using LLMs for Enterprise Threat Modeling | Ben Oster, ThreatModeler
Source: YouTube · Cloud Security Podcast · published Oct 27, 2026 · 35:32
BLUF: AI is transforming threat modeling from a rare, point-in-time exercise into a continuous, scalable process that allows security teams to monitor organizational risk in real-time, though it necessitates a shift in how human expertise and entry-level roles are utilized.
Key Takeaways:
• The traditional threat modeling process is largely obsolete; roughly 80% of models are created once and never revisited because they are too resource-intensive to maintain 0:13.
• Large Language Models (LLMs) have drastically reduced the time required to generate threat models from weeks or months to mere hours or minutes by ingesting code, architecture docs, and context 0:17.
• Security professionals should view AI as a "chief of staff" that identifies meaningful architectural changes, rather than a replacement for human judgment, which remains critical for validation 28:24.
• Developers cannot be trusted to assess security implications of every Pull Request; instead, automated systems must detect when a small change cascades across thousands of microservices 0:41.
• Organizations should aim for a holistic, continuous view of organizational risk rather than isolated application models, as DIY continuous solutions are often unsustainable due to high maintenance costs 16:25.
Closing Statement:
The industry is moving toward a model where threat modeling is an automated, continuous feedback loop integrated into the development lifecycle. This shift requires security leaders to adapt their programs to focus on high-level risk management and human-in-the-loop validation rather than manual, periodic assessments.
Sources:
- 0:13 Discussion on how 80% of traditional threat models are never revisited.
- 0:17 Impact of AI on reducing threat modeling time from months to minutes.
- 0:41 The risk of small changes cascading across microservices and the need for automated monitoring.
- 16:25 The necessity of a single, continuous organizational view of threat models.
- 28:24 The role of AI as an assistant that flags meaningful changes for human review.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Now you can build an attack at the same pace you can build an application using AI. >> in cybersecurity for at least 17 plus years and I don't remember ever going back to the first threat model that I did for an application. >> It's said that 80% of the models never get revisited. >> In probably about 6 to 9 months, you've gone from this is a multi-week, multi-month project to you can have a threat model for complex application in hours, if not minutes. >> I don't think of AI as this thing that's going to replace everybody's job, but I worry about the entry-level jobs. >> As security people, we love threat modeling, but the engineering absolutely hates it. >> A small change that cascades across a microservice to 3,000 different locations is not a small change, even if it feels like a small…