Threat modelling is the security architect's oldest analytical tool and the one whose output has aged worst. A workshop document describes the system on the day of the workshop, and within weeks a retrieval source is added, an agent is given a new tool or a permission is widened, so the document describes a system that no longer exists. This chapter concerns three of the four shifts: Shift 1, from documents to code, because the threat model becomes a versioned artefact generated from the architecture repository and tested by the pipeline; Shift 3, from periodic to continuous, at machine speed, because the model is regenerated on every change that moves a boundary; and Shift 4, from sole author to conductor of an AI team, because an AI proposes candidate threats while the architect remains the accountable verifier of every one.
The chapter builds on the conclusions that threat models belong in code beside the architecture (161, Nordqvist, 2025), that every threat names a control and every control an owner (163, Nordqvist, 2026), and that AI proposes while a named reviewer decides (164, Nordqvist, 2026). It leaves the architecture model to Chapter 5, the design of boundaries to Chapter 7, the control catalogue to Chapter 9 and the general techniques for reviewing AI output to Chapter 14.
The Threat Modeling Manifesto frames the practice around four questions: what are we working on, what can go wrong, what are we going to do about it, and did we do a good enough job (48, Threat Modeling Manifesto Working Group, 2020). Shostack teaches the same four (69, Shostack, 2014), and the manifesto prefers "continuous refinement over a single delivery". Yet because a workshop needs the right people in a room for a day, it happens once, and the last question is never asked again about the system as it became.
Primary topics explored
- What threat modelling was for
- A shared vocabulary
- Threat models generated from the architecture
- Modelling AI and agentic systems
- AI-assisted threat modelling
- Deciding candidate threats
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 6: Threat Modelling Transformed: Continuous, Generated and AI-Assisted in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Craft” and is one of 31 drawn from the manuscript.