7 AI Threat Modeling Frameworks Compared (2026)

Analysis date: 24 July 2026. Sources: the PHANTOM-B whitepaper (Shostack + Associates White Paper #6, Jul 2026), the AGENTIC whitepaper (Adrian Sroka, published 24.07.2026), the CSA MAESTRO blog post (Ken Huang, 6 Feb 2025), the SAILORS GitHub repository (Vinaya Vasudevan), and current MITRE ATT&CK / ATLAS documentation.

Why This Comparison (and Why Now)

Between early 2025 and mid-2026 the threat modeling field split along a new axis. The classic tools, STRIDE for design-time analysis and MITRE ATT&CK for adversary behavior, were built for deterministic software. LLMs broke some of their assumptions (inputs and instructions share one channel; outputs are probabilistic), and agentic AI broke more (autonomous action, tool access, persistent memory, self-modification). The response has been a wave of AI-native frameworks, four of which are compared here. Notably, three of the four (SAILORS revisions, PHANTOM-B, AGENTIC) shipped in July 2026, and they cite each other. This is a field converging in real time, with each new framework explicitly positioning itself relative to STRIDE and MAESTRO rather than claiming to replace them.

AI Threat Modeling vs AI Governance vs AI That Does Threat Modeling

Three different questions get mixed together under “AI threat modeling,” and they have three different answers. This article covers the first one only.

Frameworks for threat modeling AI systems. Structured ways to ask what can go wrong in a system that contains models, agents, tools and memory. That is STRIDE, MAESTRO, PHANTOM-B, AGENTIC, SAILORS, ATT&CK and ATLAS: the subject of this comparison.

AI governance frameworks. NIST AI RMF, ISO/IEC 42001, Google SAIF and their peers answer a different question: how an organization manages AI risk as a program. They tell you what to govern, not what an attacker does to your agent. They appear in the ecosystem table below, not the core comparison.

AI that performs threat modeling. A third, separate topic: using LLMs and agents to run the analysis itself. None of the seven frameworks here requires it, though several are starting to attract tooling. If that is the question you came with, it deserves its own article rather than a paragraph here.

Three Kinds of Artifact

Below are seven items often discussed as if interchangeable, but they are not. They belong to three categories.

1. Threat-elicitation aids give humans a structured way to ask “What can go wrong?” during design: STRIDE (six categories), PHANTOM-B (eight LLM threat genres used as prompts), AGENTIC (seven elements with guiding questions). Cheap to learn, fast to run, dependent on the modeler’s judgment.
2. Methodologies prescribe a full process. MAESTRO is the only one here: decompose the system into a seven-layer reference architecture, threat-model each layer and the cross-layer interactions, then risk-assess, mitigate and monitor. SAILORS sits at this category’s edge; it is a per-capability control checklist, closer to a mitigation gate than to threat elicitation.
3. Knowledge bases catalog observed adversary behavior: ATT&CK for conventional operations, ATLAS for attacks on AI systems. As the AGENTIC paper puts it, a knowledge base is “a threat dictionary, not a modeling method; it doesn’t tell you where to start.” They are how you make an elicited threat concrete, and how you connect modeling to detection.

Framework Profiles

1. STRIDE (Microsoft, 1999)

Created by Loren Kohnfelder and Praerit Garg at Microsoft in 1999 and popularized through the Microsoft SDL and Adam Shostack’s Threat Modeling: Designing for Security, STRIDE names six threat categories, Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege, each the violation of a security property (authentication, integrity, non-repudiation, confidentiality, availability, authorization). It is typically applied per element of a data-flow diagram, inside the Four Question Framework (What are we working on? What can go wrong? What are we going to do about it? Did we do a good job?).

After 25+ years it remains the shared baseline: every AI-native framework in this analysis defines itself against it. Its gaps for AI are well characterized in the MAESTRO paper: no vocabulary for adversarial ML (data poisoning, model extraction, evasion), no way to model autonomy or goal misalignment, and no concept of agent-to-agent interaction. The PHANTOM-B paper’s position is the practical consensus: STRIDE still applies to the whole system; the DFD doesn’t even need new notation for LLMs or MCP servers, while an AI-specific lens covers the model subset.

Sources: STRIDE: Kohnfelder & Garg, “The Threats to Our Products,” Microsoft 1999; Shostack, Threat Modeling: Designing for Security, 2014

2. MITRE ATT&CK (2013-15; v19, April 2026)

ATT&CK is a curated knowledge base of adversary tactics, techniques and procedures drawn from real-world observation, across Enterprise, Mobile and ICS matrices. It is not a threat modeling method; it is the industry’s shared vocabulary for what attackers actually do, used for detection engineering, red teaming, gap assessment and threat intelligence. It is also actively maintained in a way none of the newer frameworks yet match: v18 (Oct 2025) replaced legacy detections with structured Detection Strategies and Analytics; v19 (Apr 2026) split the Defense Evasion tactic into Stealth and Defense Impairment and extended sub-techniques to ICS.

For AI systems, ATT&CK covers the conventional substrate an agent runs on (the infrastructure, identity and lateral-movement threats MAESTRO places in its Layer 4), but says nothing about model- or agent-specific behavior. That is deliberately delegated to its sibling, ATLAS.

Sources: MITRE ATT&CK: attack.mitre.org; v19 release notes, April 2026; v18 announcement

3. MITRE ATLAS (2021; agentic expansion 2025-26)

ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) mirrors ATT&CK’s structure for attacks against AI: roughly 16 tactics and 80+ techniques as of 2026, grounded in real incidents and red-team case studies (prompt injection, data poisoning, model extraction, jailbreaks). Its 2025-26 updates are significant for this comparison: dozens of new or rewritten agent-focused techniques (MITRE reports 45+ new techniques and sub-techniques across the 2025-26 releases), including agent tool credential harvesting, poisoned agent tools, and “AI agent clickbait”, content crafted to manipulate an agent’s decision-making rather than a human’s.

ATLAS is the strongest evidence base in the field and maps threats to detections and mitigations. Its cost is effort: the PHANTOM-B comparison table rates it high effort to learn and use (versus PHANTOM-B’s low/low), and it presumes you already know which component to interrogate.

Sources: MITRE ATLAS: atlas.mitre.org; 2026 agentic updates per Zenity Labs and Vectra

4. MAESTRO: The CSA Framework for Agentic AI (Cloud Security Alliance / Ken Huang, February 2025)

MAESTRO (Multi-Agent Environment, Security, Threat, Risk, and Outcome) was the first serious attempt at an agentic-AI-native methodology. It opens with a critique of six classic frameworks (STRIDE, PASTA, LINDDUN, OCTAVE, Trike, VAST) and their AI gaps, then builds on Ken Huang’s seven-layer reference architecture: L1 Foundation Models, L2 Data Operations, L3 Agent Frameworks, L4 Deployment & Infrastructure, L5 Evaluation & Observability, L6 Security & Compliance (a vertical layer), L7 Agent Ecosystem. Each layer gets a threat landscape (L7 alone lists 13, from agent impersonation to marketplace manipulation); cross-layer threats (supply chain, lateral movement, goal-misalignment cascades) and eight architecture patterns with worked scenarios round it out, plus a six-step process from decomposition to continuous monitoring.

Its strengths are comprehensiveness and the layered decomposition itself, which remains the best mental model for where an agentic threat lives. Its weakness is unanimously identified by the newer papers: cost. The AGENTIC paper calls it “too complex, demanding deep technical expertise,” and exists specifically to lower that barrier. Shostack’s comparison table rates its learning effort “very high” and notes it doesn’t align with the industry-standard Four Question Framework. MAESTRO is the deep end, appropriate for specialists reviewing genuinely multi-agent platforms.

Sources: MAESTRO: Ken Huang, Cloud Security Alliance blog, 6 Feb 2025

5. SAILORS (Vinaya Vasudevan, 2026)

SAILORS is a practitioner-level checklist for a single AI capability, one RAG pipeline, one tool-calling feature, one LLM-backed endpoint, answering “What do we check before this ships, and again at every significant change?” Its seven checks: Sanitize all inputs; Access controls at retrieval; Inspect and filter outputs; Least privilege for tools (including resource/token exhaustion); Override gate for humans (both consequential actions and any mid-session scope expansion); Record every action (with logs routed through channels the agent can’t modify); and System prompt hardening. It cross-references OWASP’s LLM Top 10, Agentic Top 10, MITRE ATLAS, and explicitly hands off cross-agent trust questions to MAESTRO.

It is the youngest and least proven item here; an early-stage, single-author repo revised in July 2026 after practitioner review, with a proof-of-concept scanner in progress. But it fills a real gap the others leave open, none of the elicitation frameworks tell a team what to verify at the ship gate. Strictly speaking it is a mitigation checklist rather than a threat model, the AGENTIC paper characterizes it exactly that way, which is why it pairs well with, rather than substitutes for, the others.

Sources: SAILORS: github.com/vinayavasu/SAILORS (MIT, incl. July 2026 revisions)

6. PHANTOM-B: Shostack’s LLM Threat Modeling Mnemonic (Adam Shostack, July 2026)

PHANTOM-B (White Paper #6, v1.0, CC-BY) is a deliberate STRIDE analog for the question: “What can go wrong with the LLM parts of the system?” Eight threat genres: Prompt injection (direct, indirect, multi-stage, “currently unsolvable,” best understood as demonstrating absent controls); Hallucination (LLMs are always hallucinating; some outputs happen to be at odds with facts); Anthropomorphization (treating token predictors as thinking beings, including expecting “do not do X” to work); Non-explainability (post-hoc LLM explanations are fabrications; probabilistic outputs resist debugging); Training issues including poisoning (~250 documents suffice regardless of model size, citing Souly et al. 2025); Over-reliance (accepting outputs because it’s cheaper, distinct from anthropomorphization); Missing security engineering (the catch-all: an LLM magnifies every skipped SDL practice); and Biases (three business outcomes: bad answers, perceived bad answers, breaking the law).

Design choices are explicit: caller’s perspective only (not trainers), threats only (no mitigations, same choice as Google SAIF), practical over academic, used as prompts rather than cubbyholes, and slots into the Four Question Framework with STRIDE covering the rest of the DFD. Its distinctive contribution is the socio-technical genres, anthropomorphization, over-reliance, non-explainability, bias, which no other framework here names. Scope is its limit: agent-specific concerns (memory, tool chaining, self-modification) surface only obliquely, and it is a v1.0 published this month.

Source: PHANTOM-B: Shostack + Associates White Paper #6, July 2026 (v1.0, CC-BY)

7. AGENTIC (Adrian Sroka, July 2026)

AGENTIC targets the gap PHANTOM-B leaves and MAESTRO overshoots: agent-level risk, accessible to non-specialists (security champions, developers, deployment owners). Seven elements, each with a plain-language guiding question: Autonomy (“How much can the agent do before anyone notices?”); Grounding (“How does the agent know that what it ‘knows’ is true?”); Environment (“What can it run or change?”); Neural memory (“What does it remember between sessions?”); Tools (“What’s the worst thing it could do by combining its tools?”); Iterative self-modification (“How can it modify itself?”); and Control (“Can anyone shut it down before it’s too late?”). The process is sequenced (A→G→E→N→T→I→C, each element cross-examined against risks already found), written down, with the single weakest point per element flagged as a high-risk candidate.

Its non-goals are stated with unusual clarity: no model/training-level threats (→ ATLAS), no single-prompt analysis (→ OWASP LLM Top 10), no regulatory compliance, and no claim to remove subjectivity; it only structures it. It is the most agent-native elicitation aid here (self-modification and shutdown control appear nowhere else so directly) and positions itself as a bridge toward MAESTRO. Like PHANTOM-B it is brand-new (published 24.07.2026) and unvalidated at scale.

Source: AGENTIC: Adrian Sroka, whitepaper published 24.07.2026

Head-to-Head: All 7 Frameworks Compared

Coverage Matrix: What Each Framework Actually Covers

● explicit coverage · ◔ partial or indirect · – out of scope

Three readings of this table. First, no single framework covers even two-thirds of the domains; layering is mandatory, not optional. Second, the complementarity is almost suspiciously clean: PHANTOM-B owns the socio-technical row, AGENTIC owns self-modification and control, MAESTRO owns multi-agent, and ATLAS owns evidence and detection. Third, the classic frameworks still own the bottom rows: an agent platform’s Kubernetes cluster is threatened by exactly the things ATT&CK and STRIDE have always described.

Convergences and Tensions

Convergences. All four AI-native frameworks agree STRIDE is necessary but not sufficient. All agree threat modeling must be continuous, not a launch gate: MAESTRO’s monitoring step, SAILORS’ “re-run at every significant change,” PHANTOM-B’s genre framing for a moving stream of new issues. And all converge on the same root cause, instructions and data share one channel in an LLM; so injection-class threats are structural (“currently unsolvable”, Shostack), and every layer above inherits that.

Tensions. Three are worth noting. Mitigations in or out: PHANTOM-B deliberately excludes controls (they change faster than threats); SAILORS is nothing but controls; MAESTRO includes both. This is the sharpest philosophical divide, and it is why PHANTOM-B + SAILORS is a natural pairing rather than a redundancy. Process alignment: Shostack faults MAESTRO for not aligning with the Four Question Framework; MAESTRO’s authors would presumably answer that agentic systems need a new decomposition, not new questions inside the old one. Anthropomorphization: PHANTOM-B argues the word “agentic” is itself an anthropomorphization risk; a quiet critique of the entire framing the other frameworks are built on.

Shared gaps. None of the seven offers quantified risk scoring (MAESTRO gestures at a risk matrix without operationalizing it). Only ATT&CK/ATLAS are empirically validated; the four 2025-26 frameworks are expert synthesis awaiting field evidence. Tooling is nascent everywhere: SAILORS’ scanner is a PoC, and none of the elicitation aids has automation comparable to what exists for STRIDE. And, all of them (except a nod in AGENTIC’s non-goals) leave regulatory mapping (EU AI Act, ISO/IEC 42001) to the reader.

Which Framework Should You Use?

As a stack: model the whole system with STRIDE; interrogate every LLM call with PHANTOM-B; interrogate agent behavior with AGENTIC, escalating to MAESTRO when systems are multi-agent or high-stakes; gate every shipped capability (and every significant change) with SAILORS; and translate the resulting findings into ATLAS/ATT&CK techniques so detection and red teams can act on them. Re-run at every significant change; the one point on which all seven agree.

What The Core Seven Leave Out: The Wider Ecosystem

The seven frameworks above were the analysis scope, but the papers themselves cross-reference a wider ecosystem. Fifteen adjacent frameworks are worth naming; none change the layering conclusion, but two arguably belong in the core comparison.

Two of these above would have earned a seat in the core table. The OWASP Top 10s function as the field’s shared vocabulary, all three 2026 frameworks define themselves partly through mappings to them, and the Agentic Top 10 (ASI01-ASI10) is the closest thing to an industry-consensus risk list for agents. And, NIST AI RMF is the right answer if the question is organizational governance rather than engineering-time modeling. The rest are complements at different layers: privacy (LINDDUN), training-side depth (BIML), controls (SAIF), validation (CSA red teaming), and prioritization (DREAD, PASTA).