AI-Powered Threat Modeling: The Future of Cybersecurity by Arun Kumar Elengovan, Director of Engineering Security at Okta, Inc.

Re-imagining Threat modeling with Gen AI and LLMs

As enterprise systems grow in complexity, traditional threat modeling while essential, struggles to keep pace with evolving architectures and shrinking development cycles. This paper explores a novel, LLM-powered approach to threat modeling, where generative AI augments the process by infusing context awareness, prompt driven automation, and multimodal input handling. By leveraging techniques such as Retrieval-Augmented Generation (RAG), structured prompt engineering (e.g., COSTAR), and diagram ingestion via multimodal models, organizations can drastically accelerate and enhance their ability to foresee and mitigate potential threats. The methodology also emphasizes human oversight, ensuring that AI output remains grounded in real world judgment. Framed through a "Minority Report" style lens of predictive security, this work presents a systematic, actionable guide to building context-sensitive, scalable threat modeling tools turning what was once a manual, expert driven activity into a democratized, AI-assisted practice. The result is a shift-left security state that’s not just efficient, but inevitable.

Transcript

1. AI-Powered Threat Modeling: The Future of Cybersecurity Keynote at the 5th International Conference on Intelligent Vision and Computing ICIVC 2025 Re-imagining Threat modeling with Gen AI and LLMs Arun Kumar Elengovan Director of Engineering Security, Okta
2. Safe Harbor Statement This communication may contain forward-looking statements that involve risks, uncertainties, and assumptions. All statements other than statements of historical fact are statements that could be deemed forward-looking, including statements about business strategies, market opportunity, product development, future operations, and expected performance. These statements are based on current expectations and assumptions and involve a number of risks and uncertainties that could cause actual results to differ materially from those expressed or implied in the forward-looking statements. I undertake no obligation to update or revise any forward-looking statements, whether as a result of new information, future events, or otherwise, except as required by law. The views and opinions expressed are my own and do not necessarily reflect those of any affiliated organizations.
3. Where Curiosity Triggered Context for Arun Seasoned Security Engineer Expert in securing large-scale platforms and distributed systems. Focuses on secure software development and strategic security planning. AI & LLM Security Pioneer Thought leader who developed threat modeling frameworks and controls for secure integration of generative AI in engineering. Security Leadership & Mentorship Mentors engineers, leads tabletop exercises, and champions secure-by-default practices. Connects technical implementation with strategic vision. Starting with cryptography and key management, I saw how LLMs could streamline the repetitive logic in threat modeling. That shift took me from securing keys to securing context.
4. From Sci-Fi Vision to Reality Inspired by Sci-Fi Remember "Minority Report"? It showed a future where crimes were stopped before they happened. Imagine a cybersecurity expert instead of Tom Cruise, and AI models instead of precogs. This is what we're starting to see in modern threat modeling. Old Threat Modeling In cybersecurity, threat modeling tries to stop attacks before they happen. Traditionally, this meant manually mapping systems and reacting to threats. It was limited by human knowledge and effort. New AI Approach Our AI-enhanced approach uses AI to predict and find threats, working faster and better than humans alone. It acts like "precrime" for cyber threats, helping us focus defenses where they are needed most, much like the movie's analysts seeing future crimes. The evolution of threat modeling from science fiction inspiration to modern AI-powered reality, transforming reactive manual analysis into predictive cybersecurity.
5. Threat modeling demystified Threat modeling is a systematic process to: 1 Identify Security risks and vulnerabilities in a system 2 Enumerate Potential attack vectors and attack channels 3 Prioritize The most likely and relevant threats to address It's the ultimate "shift left" process - identifying vulnerabilities even before they become real issues. This helps: 1 Re-Prioritize Security issues and remediation activities 2 Integrate Security into the software development lifecycle 3 Achieve harmony between development and security teams Threat modeling is a key part of software quality assurance and helps meet compliance and regulatory requirements.
6. Stats indicate ... 1 Gaining Revenue Insight: 11–25% Boost 56% of companies reported seeing an 1125% increase in revenue from implementing threat modeling—showing a direct impact on the bottom line. 2 NYC Cyber Command's Proven Success After training 25 personnel: • 147 unique threat mitigations were designed • Over 120 days, these measures blocked 541 intrusion attempts, prevented 5 privileged account hijacks, and fixed 3 public-facing server vulnerabilities 3 Operational Efficiency Saves $840K/Yr A Security Compass study found that automating threat modeling saved more than $840,000 annually for a team of developers and security staff earning $150K each Over Half of Organizations Don't Yet Practice It A Reddit cybersecurity survey lamented that "Threat modeling is rare because most customers want to spend on developers building software—not drawing diagrams"
7. LLMs Transform Security Strategy Design Phase Integration before coding begins Risk Assessment AI-flagged vulnerabilities DevSecOps Alignment Engineering, Security, QA in harmony Deployment Built-in security from start
8. AI Powered : Threat Modeling Roadmap Context-Aware Intelligence Prompt Engineering Excellence Multimodal Analysis Capabilities Interactive Threat Discovery 1 2 3 4
9. 1. Context-Aware Intelligence Legacy Models Historical threat data Source Code Actual implementation details Architecture System design documents Known Vulnerabilities Previously identified issues
10. RAG Model (Retrieval-Augmented Generation) Contextual Data for Your Organization Understand Your Unique Risks The RAG model assesses your organization's specific security posture. It analyzes your unique infrastructure, threat landscape, and security controls to provide a tailored view of your risks. Prioritize Critical Threats You may use the RAG model to categorize organizational risks into priorities. This allows you to focus efforts on the greatest threats to your organization. Take Confident Action With RAG model, you make informed decisions and implement targeted security measures. This contextual approach aligns your cybersecurity strategy with your unique business needs.
11. Let's visualize RAG
12. 2. Prompt Engineering Excellence Prompt engineering is crucial for effective GenAI threat modeling. It involves using frameworks like COSTAR, avoiding common pitfalls, and applying best practices for precise and actionable AI outputs. COSTAR Framework • Context setting • Clear objectives • Structured responses Common Pitfalls • Vague requests • Missing context • Overly broad scope Best Practices • Specific terminology • Clear boundaries • Iteration-based refinement
13. 3. Multimodal Analysis Capabilities 1 Image Input Upload architecture diagrams, network maps 2 Pattern Recognition AI identifies security gaps visually 3 Correlation Analysis Links visual elements to known threats 4 Recommendation Output Visual + textual security guidance
14. 4. Interactive Threat Discovery Smart Questioning AI asks about APIs, roles, data boundaries Gap Identification Reveals blind spots in security planning Risk Flagging Highlights areas with insufficient information Knowledge Building Improves with each interaction
15. Human-AI Partnership Human Judgment Final decision authority AI Analysis Speed, scale, pattern recognition Knowledge Base Organizational context, history By leveraging the unique strengths of both, this human-AI partnership can tackle challenges more effectively.
16. Proven Frameworks as Foundation Foundational Frameworks STRIDE Microsoft-originated framework for identifying design-time threats such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. PASTA A 7-stage process aligning technical risk with business impact, from objectives to attack modeling. LINDDUN A privacy-focused threat modeling framework designed for regulatory compliance and data protection.
17. Complementary Methodologies VAST Designed for Agile and DevSecOps, this framework scales across organizational and technical layers. Attack Trees Visual diagrams mapping potential attacker paths and methods to achieve malicious goals.
18. Key Takeaways 1 AI-Powered Threat Modeling We walked through how AI and machine learning are transforming the field of cybersecurity through advanced threat modeling capabilities. 2 Contextual Intelligence The system leverages AI to gather and analyze data from multiple sources, providing a comprehensive, context-aware understanding of security risks facing an organization. 3 Prompt Engineering Expertise Skilled prompt engineering enables the AI models to deliver actionable insights for threat detection, assessment, and mitigation strategies. 4 Multimodal Analysis The system's ability to process and synthesize diverse data types, from logs to network traffic, leads to more thorough and accurate threat assessments. 5 Human-AI Collaboration How human security experts can interactively work alongside the AI system to explore, understand, and address evolving cybersecurity threats. 6 Proven Frameworks The solution is built on established security frameworks and best practices, providing a robust and reliable foundation for organizations to enhance their cybersecurity posture.
19. Final Remarks: The Future is Human + Machine Accelerated Analysis Faster identification of critical threats Expanded Coverage More comprehensive threat detection Proactive Advantage Security as competitive differentiator