// tool reference · Vulnerability & Assessment
AI Threat-Model & Attack-Surface Analyzer Pro
Describe your architecture for a STRIDE threat model: per-component threats, attack paths, MITRE mapping, controls, and residual-risk score.
Open AI Threat-Model & Attack-Surface Analyzer →
What it does
Describe an architecture and receive a STRIDE threat model with trust boundaries and prioritised mitigations — the design-review artefact most teams skip because it is slow to produce.
When to use it
- Before building; during a design review; when a security questionnaire asks for a threat model.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| arch | textarea | required | Architecture description — components, data flows, trust boundaries. |
| exposure | select | optional | Exposure profile (internal, internet-facing, multi-tenant). |
What you get back
STRIDE analysis per component, trust boundaries, and ranked mitigations.
Worked example
Input
A React SPA calls a REST API. The API reads/writes Postgres and calls Stripe. JWTs are issued at login. Files upload directly to S3.
Output (abridged)
TRUST BOUNDARIES
1. Browser -> API (untrusted -> semi-trusted)
2. API -> Postgres (semi-trusted -> trusted)
3. API -> Stripe (semi-trusted -> external)
4. Browser -> S3 (untrusted -> trusted store) <- highest risk
STRIDE -- selected
Spoofing JWT issued at login. If 'alg' is read from the token header,
an attacker signs their own. Pin it server-side.
Tampering Boundary 4: a browser-issued upload lets a client control
object key and content-type. Pre-sign narrowly; never trust
a client-supplied path.
Repudiation No audit trail mentioned. Payment actions need one.
Info disc. JWT payload is base64, not encrypted. No PII in claims.
DoS Stripe call is synchronous -- a Stripe stall becomes your
outage. Timeout + circuit-break.
Elevation Boundary 2: does the API connect as a superuser? Least
privilege; no DDL at runtime.
TOP 3: (1) JWT alg pinning (2) S3 pre-sign scope (3) DB least privilege
How it works
AI structured to the STRIDE framework.
Limits
Read live from the platform configuration.
| Rate limit | 4 requests / 10 minutes |
Limitations — what it does not do
A model of what you DESCRIBED, not of what you built. It cannot see your code, so it cannot confirm a control exists. Use it to structure the review, not to conclude it.
Privacy
Your architecture description is sent to the AI provider.
Standards
STRIDEOWASP ASVSNIST CSF