AI-Enhanced Threat Modeling: How to Reduce the Cognitive Load of a Security Architect Without Relinquishing Control

This talk presents the blueprint of a system based on RAG (Retrieval-Augmented Generation) and LLMs designed to accelerate threat modeling activities. The objective is to create a "cybersec tactical droid" that assists the security architect by processing large volumes of input—such as documentation, configurations, diagrams, and code—transforming them into an evidence map. Utilizing a predefined set of questions or "investigative rules" (STRIDE/PASTA/DREAD) mapped to NIST and MITRE ATT&CK frameworks, the assistant proposes the queries most pertinent to the context represented by the ingested documentation. Depending on the operational mode, the security architect may choose to utilize the question list in a traditional investigative manner or delegate the generation and autonomous execution of investigative prompts to the cybersec tactical droid. Fortunately, the Death Star engineers lacked this droid model; otherwise, they would have identified a small thermal exhaust port leading directly to the reactor core.