Toreon Office | Grotehondstraat 44 1/1 - 2018 Antwerpen | +32 3 369 33 96
49th Edition – December 2025
Welcome to this month’s edition of Threat Modeling Insider! In this edition, we take a look back at our talk given at German OWASP Day back in November, by Sebastien Deleersnyder & Georges Bolssens.
Meanwhile, on the Toreon blog, Robert Hurlbut highlights the relation between Threat Modeling & Embedded Systems, showing how in modern society, threat modeling is critical for embedded systems.
There’s plenty of other actionable insight ahead, so settle in and let’s get started!
Welcome to this month’s edition of Threat Modeling Insider! In this edition, we take a look back at our talk given at German OWASP Day back in November, by Sebastien Deleersnyder & Georges Bolssens.
Meanwhile, on the Toreon blog, Robert Hurlbut highlights the relation between Threat Modeling & Embedded Systems, showing how in modern society, threat modeling is critical for embedded systems.
There’s plenty of other actionable insight ahead, so settle in and let’s get started!
Presentation Recap
In November 2025, Sebastien and Georges from Toreon delivered a presentation titled “The Automation Illusion: What Machines Can Do in Threat Modeling” at the German OWASP Day.
Curated content
AI-Powered Cyber Espionage: A Groundbreaking Threat Landscape
Curated Content
Threat Modelling Isn’t a Security Exercise — It’s a Design Discipline
Tips & tricks
Threat Modeling Tool Directory
Training update
An update on our training sessions.
This blog post is based on research we conducted for ThreatModCon Washington, which was recently recorded as part of German OWASP Day. The link to the recording is available below, and you can download the slides from LinkedIn.
As part of our research for the presentation on threat modeling automation and tooling, we examined available threat modeling tools and compiled a list, which is available here on GitHub. This directory focuses exclusively on threat modeling tools—software, code, libraries, or services that automate, guide, or support the design-time threat modeling process.
For decades, we’ve hoped the next great technology would solve security, allowing us to kick back and work less. Now, Artificial General Intelligence (AGI) promises to perform “any intellectual task a human can”, leading many to assume it will solve the challenge of scaling a threat modeling program. The truth? Threat modeling (TM) is a “human-centric messy process” that desperately needs speed and consistency. While tools are rapidly improving, automation is presenting a major illusion: it supports the job, but it certainly doesn’t do the entire job for you. The genuine problem is not a lack of tools—it’s the human element. Read on to understand where the current technology stands and how your security team can master this crucial “skill shift.”
The sheer velocity of modern software development is running circles around traditional TM practices. Our most significant pain points stem from a lack of predictability and resource scarcity.
This is the context that gives rise to the idea of a “Threat Modeling General Intelligence (TMGI)”—a system to replicate the most expert human threat modelers across all domains.
The integration of Generative AI into TM tooling is not science fiction; it’s happening now. The number of dedicated TM tools has surged (see our online Threat Modeling Tool Directory), and many are actively incorporating genAI.
These tools are rapidly moving us from simple checklists to a state of TM-Automation.
Despite these advances, the core challenge remains: automation doesn’t equal completion. The idea that a machine can take over is an illusion of automation.
The reality is that AI is driving a shift in skills, not their elimination. You need to transform your team from security police to high-impact strategic experts.
We are moving through the stages of AI adoption: from being Skeptics to Explorers (using AI for basic TM steps) to Collaborators (co-creating multi-step processes). The ultimate goal is to become an AI Strategist.
The future of threat modeling is a highly effective collaboration between human intellect and machine efficiency.
The automation illusion suggests that simply buying a tool won’t solve your scaling threat modeling program problems. The reality is more nuanced: AI is a powerful copilot that eliminates tedious work and lets your team focus on strategic risk management.
To truly scale, your security team must evolve. They need to understand how to prompt effectively, integrate LLMs into dev toolchains, and, most importantly, provide the human judgment, verification, and critical soft skills necessary to secure buy-in across the organization.
Ready to empower your security team to master the new era of threat modeling? Our specialized threat modeling training is designed for this exact skill shift. We train your team to effectively use these new tools and lead the security conversation in your company.
In modern society, everywhere we look, we see examples of embedded systems at work: IoT devices in our homes, critical controllers in industrial facilities, medical devices, and all kinds of vehicles. Despite their ubiquity and importance, these systems often lack robust security frameworks comparable to those in traditional IT systems. This is where threat modeling becomes critical, providing a way to think about secure design and focusing on understanding and mitigating embedded system threats.
Anthropic disclosed a sophisticated AI-orchestrated cyber espionage campaign allegedly conducted by a Chinese state-sponsored group, demonstrating how AI can autonomously execute complex cyber attacks with minimal human intervention.
Key Takeaways are:
When treated as a continuous, collaborative practice rather than a security checkbox, threat modelling improves architectural clarity and encourages engineers to think about risk before code is written. Ultimately, embedding threat modelling early leads to cleaner designs, better documentation, and a stronger security culture across the entire team.
Key Takeaways are:
Threat modelling is a mental model and design practice, not a vulnerability-hunting exercise owned solely by security teams
It should be a continuous, evolving process that adapts alongside architectural and system changes
Practising threat modelling early results in clearer architectures, more focused testing, and a more security-aware engineering culture
Anthropic disclosed a sophisticated AI-orchestrated cyber espionage campaign allegedly conducted by a Chinese state-sponsored group, demonstrating how AI can autonomously execute complex cyber attacks with minimal human intervention.
Key Takeaways are:
When treated as a continuous, collaborative practice rather than a security checkbox, threat modelling improves architectural clarity and encourages engineers to think about risk before code is written. Ultimately, embedding threat modelling early leads to cleaner designs, better documentation, and a stronger security culture across the entire team.
Key Takeaways are:
Threat modelling is a mental model and design practice, not a vulnerability-hunting exercise owned solely by security teams
It should be a continuous, evolving process that adapts alongside architectural and system changes
Practising threat modelling early results in clearer architectures, more focused testing, and a more security-aware engineering culture
As part of our research for the presentation on threat modeling automation and tooling, we examined available threat modeling tools and compiled a list, which is available below on GitHub. This directory focuses exclusively on threat modeling tools—software, code, libraries, or services that automate, guide, or support the design-time threat modeling process.
Half day Workshop Threat Modeling with AI, in-person, CodeMash Conference, Ohio
12-16 January 2026
2-Day Training: AI Threat Modeling Next Generation: From Whiteboard Hacking to Hands-on Prompting, in-person, London OWASP Training Days, UK
25-26 Feb 2026
Threat Modeling Practitioner training, hybrid online, hosted by DPI, US Cohort
March 2025
Half day Workshop Threat Modeling with AI, in-person, CodeMash Conference, Ohio
12-16 January 2026
2-Day Training: AI Threat Modeling Next Generation: From Whiteboard Hacking to Hands-on Prompting, in-person, London OWASP Training Days, UK
25-26 Feb 2026
Threat Modeling Practitioner training, hybrid online, hosted by DPI, US Cohort
March 2025
Advanced Whiteboard Hacking – aka Hands-on Threat Modeling, NorthSec Training, Montreal
10-11 May 2026
Threat Modeling Practitioner training, hybrid online, hosted by DPI, Europe Cohort
June 2025
Advanced Whiteboard Hacking – aka Hands-on Threat Modeling, NorthSec Training, Montreal
10-11 May 2026
Threat Modeling Practitioner training, hybrid online, hosted by DPI, Europe Cohort
June 2025
TBD
TBD
