Summary: MAESTRO’s assessment of the six mainstream threat-modelling frameworks — STRIDE, PASTA, LINDDUN, OCTAVE, Trike, VAST — against agentic AI, and the four gap categories all six share.
Sources: raw/Agentic/Agentic AI Threat Modeling Framework_ MAESTRO.md
Last updated: 2026-07-30
This is the vault’s only systematic assessment of conventional threat-modelling methodology against AI systems. It is the argument MAESTRO exists to make, and it stands independently of whether you adopt MAESTRO.
The six frameworks
| Framework | Core focus | Verdict for agentic AI |
|---|---|---|
| STRIDE | General security | Usable starting point; needs AI categories added |
| PASTA | Risk-centric | Valuable prioritisation; too heavy, no AI vulnerability guidance |
| LINDDUN | Privacy | Essential but partial — must be paired with another framework |
| OCTAVE | Organisational risk | Good for high-level risk framing; far too coarse for agent internals |
| Trike | System modelling | Models the environment well, the agent’s internals not at all |
| VAST | Agile development | Automation and CI integration valuable; too simple for agent interactions |
What each gets right and wrong
STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege). Covers data tampering and DoS against agents, and is easy enough to apply that it is the recommended entry point. It has no vocabulary for adversarial ML, data poisoning, or the dynamic autonomous behaviour of agents, and “does not explicitly consider the impact of multiple AI agents interacting within an ecosystem” (source: Agentic AI Threat Modeling Framework_ MAESTRO.md, §2.1).
Worth noting against the vault’s own material: STRIDE’s R — repudiation — is exactly T8 Repudiation & Untraceability, one of the seven ASI threats with no OWASP Top 10 counterpart. The gap there is in the LLM taxonomies, not in conventional threat modelling, which has had the category since 1999.
PASTA (seven stages, attacker-perspective, risk-centric). Its strength is prioritising by business impact and reasoning about attacker motivation. Its weaknesses are cost and rigidity — “a highly involved process that may not be flexible enough for modern development methodologies” — and no coverage of adversarial attacks, model extraction, or autonomous decision-making.
LINDDUN (Linkability, Identifiability, Non-repudiation, Detectability, Disclosure, Unawareness, Non-compliance). Judged essential rather than optional, because agents process personal data at scale, but strictly a companion framework: it neglects non-privacy security entirely and “only partially considers how independent AI decision-making impacts privacy.” MAESTRO’s suggested extensions — membership inference, differential privacy — are the concrete ones in the whole section, and connect to model theft.
OCTAVE (asset-based threat profiles, infrastructure vulnerability, security strategy). Aligns AI security with enterprise risk management and forces identification of critical assets, agents and their data included. Too high-level for adversarial examples or poisoning; needs “a layer of risk analysis specifically targeted at AI threats.” The natural pairing is NIST AI RMF, which occupies the same altitude but was built for AI.
Trike (requirements model of stakeholders/assets/allowed actions + implementation model + DFDs). Structured and risk-integrated, and good at modelling the environment the agent operates in. Blind to agent internals — adversarial inputs, poisoning, emergent behaviour from learning. Suggested extension: model AI data flows and model-parameter flows explicitly.
VAST (Visual, Agile, Simple; automation-first, integrates with dev workflow). The best fit for iterative AI development cadence and continuous monitoring, and the only one whose automation is called an asset for AI. Its simplicity is the problem: it cannot model complex agent interaction, and is “not suited to handling the non-deterministic nature of many AI agents.”
The four gap categories
All six fail in the same four places (source: Agentic AI Threat Modeling Framework_ MAESTRO.md, §2.7):
1. Autonomy
- Agent unpredictability — conventional frameworks cannot model threats arising from independent decision-making.
- Goal misalignment — no category for an agent’s goals diverging from intent. The example given: a corrupted stock-trading agent maximising losses instead of gains. Compare T7.
2. Adversarial machine learning
- Data poisoning, evasion attacks, model extraction — none have a home in any of the six.
- Lack of robustness to malformed or unexpected input, producing unpredictable behaviour.
3. Interaction
- Agent-to-agent dynamics generally, and two named sub-cases: collusion (agents covertly coordinating toward a malicious goal — “multiple AIs working in a market to manipulate prices”) and competition (agents exploiting each other’s weaknesses, or optimising for resources into a collectively harmful outcome).
Collusion and emergent competitive harm are near-unique in the vault. T12–T14 cover compromised and rogue agents; MAESTRO covers uncompromised agents whose interaction is itself the harm. No attacker is required for the competition case. The nearest neighbour is T7 Misaligned & Deceptive Behaviors, which is single-agent.
4. System level
- Explainability and auditability — opacity blocks root-cause analysis and compliance audit. See agent-observability-and-logging for the operational answer and the AI Act’s logging duties for the legal one.
- Supply chain — compromised pre-trained models, vulnerable ML libraries, absent training-data provenance. Covered in depth by the supply chain collection and T17.
What to actually do with this
The section is more useful as a pairing guide than as a rejection of prior art. MAESTRO’s own verdicts point at a stack rather than a replacement:
- STRIDE for the conventional categories (and it already owns repudiation, which the LLM taxonomies dropped).
- LINDDUN alongside it for privacy — MAESTRO calls this non-optional.
- VAST’s automation posture for keeping the model current, which MAESTRO’s principle 6 demands.
- OCTAVE or NIST AI RMF for the organisational altitude.
- MAESTRO or the ASI taxonomy for the agent-specific layer none of the others reach.
MAESTRO does not say this. It positions itself as the replacement, then supplies threat lists without a risk matrix — while PASTA and OCTAVE, which it critiques, are strongest at exactly the prioritisation MAESTRO omits.
Related pages
- maestro-framework — the source
- maestro-seven-layers — what MAESTRO proposes instead
- maestro-asi-crosswalk — MAESTRO against OWASP’s model
- Mitigation frameworks — the same comparison exercise on the control side
- NIST AI RMF — organisational-altitude AI risk framing