Use STRIDE to ask structured security questions about an AI system, MITRE ATLAS to explore relevant adversary behaviors, and the OWASP Top 10 for LLM Applications to organize LLM-specific risks and mitigations. They cover different parts of the problem: none replaces an architecture-specific threat model, testing, or named owners for security decisions.
That distinction matters because an AI application is not just a model. It may also include prompts, retrieval sources, vector stores, agents, tools, APIs, human approvals, and downstream systems. A threat-modeling stack connects broad security questions to AI-related attack scenarios and application risks, then checks that the resulting controls fit the system actually being built.
As an Amazon Associate I earn from qualifying purchases.
What each resource contributes
| Resource | Primary role | Scope and useful output |
|---|---|---|
| STRIDE | General threat-category method | Structures questions about system components, data flows, and trust boundaries; the output is a set of architecture-linked threats to assess. Microsoft’s STRIDE reference |
| MITRE ATLAS | AI adversary tactics and techniques knowledge base | Adds AI-specific behavior and scenarios to investigate; it does not determine whether a technique applies to a particular system. OWASP’s threat-modeling directory |
| OWASP Top 10 for LLM Applications | LLM application risk and mitigation taxonomy | Provides a named risk framework to use as a checklist and map to application controls. The current edition at the time of writing is the 2026 edition, dated September 1, 2026. OWASP’s 2026 resource |
STRIDE: structure questions around the system
Microsoft describes STRIDE as a way to categorize threats and make security conversations more structured. Its categories are Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Apply them to components and flows in the architecture, rather than treating the category names as a list of AI-specific findings.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Spoofing: Could a user, service, agent, or tool impersonate another identity?
- Tampering: Could a prompt, retrieved document, model artifact, or tool result be changed without authorization?
- Repudiation: Can the system establish who requested an action, what the model or agent did, and whether a person approved it?
- Information disclosure: Could sensitive data in prompts, retrieved context, logs, or outputs reach someone who should not see it?
- Denial of service: Could an attacker exhaust model, application, or tool resources?
- Elevation of privilege: Could an attack cause the system to use permissions or take actions beyond those intended?
These are prompts for analysis, not claims that a particular AI system has these weaknesses. A STRIDE review becomes useful when each credible threat is tied to an asset or boundary, a plausible impact, existing controls, and an accountable owner.
#1 Best Overall
MITRE ATLAS: enrich the model with adversary behavior
OWASP describes ATLAS, the Adversarial Threat Landscape for Artificial-Intelligence Systems, as a globally accessible, living knowledge base of tactics and techniques targeting AI-enabled systems, grounded in real-world observations and demonstrations. Use it to ask whether an AI-related adversary behavior is relevant to a component or flow already identified in the system model. OWASP’s description of ATLAS
ATLAS is not the architecture of your system, a risk ranking for your organization, or proof that a listed technique will work against your deployment. Keep the technique’s source and the assumptions behind its applicability visible in your threat records.
OWASP’s LLM Top 10: organize application risks and mitigations
As of October 9, 2026, the current OWASP Top 10 for LLM Applications edition is the 2026 list, released September 1, 2026. OWASP says the edition updates rankings, expands coverage, draws on research grounded in thousands of real-world AI security incidents, and maps risks to MITRE ATLAS, CWE, NIST, and the OWASP Top 10 for Agentic Applications. Consult the official 2026 resource for its exact risk names and ordering rather than assuming they match the previous edition.
Rank #2
The 2025 list is historical, not the current ranking. Its risk names should not be presented as the 2026 taxonomy or assumed to have remained unchanged. OWASP’s 2025 risk page
How to combine them in a real threat model
The sequence below is a practical synthesis, not an official mandated process. It keeps the analysis anchored to a particular design while using each resource for the job it does best.
-
Map the system and its trust boundaries
Draw the user entry points, models, orchestration or agent loops, retrieval sources, vector stores, tools, APIs, sensitive data, human approval points, logs, and downstream systems. Mark where data crosses trust boundaries and which inputs and outputs are untrusted. The map should describe the deployed design, not just the model provider’s component.
-
Apply STRIDE to components and data flows
For each relevant element and flow, record the threat question, affected asset or boundary, plausible impact, current control, and owner. For example, assess whether retrieved content could be tampered with and whether an agent’s permissions could allow an unauthorized action. Record a threat only when it is credible for the architecture being assessed.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Use ATLAS to add applicable adversary scenarios
Look for AI adversary techniques and demonstrations that illuminate the threats already identified. Add a scenario when its preconditions and affected components fit the system; document assumptions instead of treating every catalog entry as an applicable risk.
-
Check the current OWASP LLM edition
Use the 2026 edition as an application-risk and mitigation checklist. For each applicable item, connect it to the component, risk owner, test or control, and residual risk. Verify exact risk names and rankings against the official edition before citing them; do not substitute the 2025 list.
-
Map gaps to control families
Microsoft’s AI defense catalog normalizes defenses against MITRE ATLAS, OWASP’s 2025 LLM Top 10, and NIST AI RMF. It groups controls across governance and assurance, supply-chain provenance, identity and least privilege, input and retrieval hygiene, model hardening, runtime isolation, output handling, monitoring and forensics, and resource governance. These are useful families for finding gaps, but the catalog’s 2025 OWASP reference does not establish that it maps the newer 2026 taxonomy. Microsoft’s AI defense catalog
-
Validate, assign, and revisit
Use the threat model to guide testing or red teaming, release decisions, monitoring, and incident response. Assign owners to residual risks and controls. Revisit the model when the architecture, tools, model or provider, data sources, or agent permissions change.
Recommended: Crashes or Glitches? A Free Driver Scan Usually Finds the Culprit →Recommended: Fix Windows Errors and Clear Junk Files in Minutes - Free Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Where AI changes the questions worth asking
AI-specific components make some familiar security boundaries easier to overlook. A retrieved document may influence an answer without being trusted; a prompt may direct an agent toward a tool; an output may be consumed by another system as if it were safe. Model the full path from input through retrieval and tool use to output and downstream action, not only the model endpoint.
- Trust boundaries: distinguish user input, retrieved context, tool responses, model output, and trusted instructions.
- Data and model integrity: consider whether sources, embeddings, prompts, or artifacts could be altered and what that change could affect.
- Tool permissions: examine the identity and authority used for each action, including whether approvals are required at consequential decision points.
- Output handling: assess how downstream consumers interpret model-generated content and whether they validate it before acting.
- Resource limits: examine exposure to excessive model calls, long agent loops, or costly tool use.
These are areas to examine, not universal findings. Their priority depends on the system’s architecture, data, permissions, and operating context.
What this stack cannot tell you on its own
A crosswalk between frameworks helps organize work; it does not prove that a control is effective or that a mapped risk has been eliminated. No comparative effectiveness conclusion follows from using STRIDE, ATLAS, or OWASP, and the OWASP community or download figures are not security-outcome measurements. The result still depends on architecture-specific analysis, validation, and clear ownership.
Keep the provenance of each item in the model: which STRIDE category shaped the question, which ATLAS scenario informed it, and which OWASP risk or mitigation was considered. That makes the analysis reviewable without confusing a framework mapping with evidence that the system is safe.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
