STRIDE, PASTA, DREAD, OCTAVE, VAST, Trike, LINDDUN, MAESTRO, the OWASP MAS Threat Modelling Guide v1.0, Shostack's Four Question Framework, and the 2026 agentic-AI specialisations of each, plus a survey of the open-source and commercial tools that automate them. Where each fits, what each costs in effort, and how Helmwart composes them for agentic systems.
Threat-modelling frameworks split along two axes: scaffold versus enumeration(a process that asks the four big questions versus a catalogue of what to look for), andhorizontal scope (per element, per business process, per architectural layer, per data class). Helmwart picks Shostack's Four Question Framework as the scaffold and layers the OWASP v1.1 base T1–T17 catalog, Helmwart-normalized MAS scenario additions, MAESTRO L1–L7 + CL, and MITRE ATLAS as the Q2 enumeration lenses.
The 2025–2026 shift is real: classical frameworks now have AI-specialised variants (ASTRIDE, PASTA-AI, LINDDUN-AI), pure-LLM threat-modelling tools have emerged (STRIDE-GPT, MAESTRO Playbook), and OWASP + CSA have published agentic-native methodologies (MAESTRO, MAS Threat Modelling Guide v1.0). Helmwart stays deterministic by design: same answers always produce the same threat list, mitigation ranking, and residual risk.
Methodologies
Order: scaffold first, then enumeration lenses by age, then the agentic-native frameworks, then the governance scaffolds.
Threat Modeling Manifesto
Shostack, Tarandach, et al., 2020
What
The values + principles document underwriting modern threat modelling. Explicitly framework-agnostic.
Strengths
Sets a shared vocabulary every other framework can plug into.
Trade-offs
Not a methodology by itself; cannot be "used" alone.
Best fit
Read once to anchor the why.
Composes
Substrate for everything below.
Shostack: Four Question Framework
Adam Shostack, 2014; paper rev. Nov 2024
What
Four questions: What are we working on? What can go wrong? What are we going to do about it? Did we do a good enough job?
Strengths
Methodology-agnostic scaffold; hosts STRIDE, MAESTRO, LINDDUN as Q2 lenses. Microsoft TMT, IriusRisk, and several academic papers now frame their workflows in these four questions.
Trade-offs
Does not tell you which enumeration lens to use; you still have to pick.
Best fit
Self-service walkthroughs; mixed audiences.
Composes
Wizard spine on /threat-modeling/.
STRIDE
Microsoft, late 1990s
What
Per-element enumeration: Spoofing / Tampering / Repudiation / Information disclosure / Denial of service / Elevation.
Strengths
The most widely deployed enumeration lens; deep tooling support; pedagogically robust.
Trade-offs
Per-element ergonomics struggle on agentic systems where emergent, cross-component behaviour is the threat.
Best fit
Conventional DFD-based systems; education.
Composes
Cited by every modern lens. Not used as Helmwart's Q2 default; layered as ATLAS adversary pivots and OWASP MAS catalog instead.
AI variant
ASTRIDE: STRIDE+A adds an "A" category for AI-Agent-Specific Attacks (prompt injection, unsafe tool invocation, reasoning subversion). The implementation uses a fine-tuned vision-language model to read DFDs and a reasoning LLM to emit threat models; it is explicitly LLM-driven.
Business-objective-first; integrates with risk management.
Trade-offs
Heavyweight; designed for committee work, not self-service.
Best fit
Regulated enterprise with formal risk owners.
Composes
Not used as wizard spine. Cited as the risk-centric counterpart.
AI variant
PASTA-AI (informal): Per-stage extensions documented in community write-ups: Stage 2 adds adversarial ML and data poisoning, Stage 5 maps to MITRE ATLAS, etc. Not a formal release.
OCTAVE
CERT/SEI
What
Operationally Critical Threat, Asset, and Vulnerability Evaluation: a workshop-driven, organisational-risk lens.
Strengths
Suited to large-organisation governance.
Trade-offs
Slow; not technical-finding-oriented.
Best fit
Programme-level posture; not single-system threat models.
A requirements- and risk-model-driven methodology. A requirements model (actors, assets, intended CRUD actions, rules) sets the acceptable risk per asset; an implementation model (DFDs) then auto-generates threats — classically only denial of service and elevation of privilege — into a stakeholder-defensible risk model.
Strengths
Automatic threat generation from the model; a repeatable, defensible risk assignment stakeholders sign off on.
Trade-offs
Open source but effectively unmaintained (the v2 methodology was never finished); narrow built-in threat set; tooling is dated and spreadsheet-bound.
Best fit
Teams wanting an auditable, risk-model-first process on conventional systems.
Composes
Not used.
LINDDUN
KU Leuven
What
Privacy-centric enumeration: Linking, Identifying, Non-repudiation, Detecting, Data disclosure, Unawareness & Unintervenability, Non-compliance. Data disclosure is EXCESSIVE collection or retention, not unauthorised access; unintervenability covers the rights people exercise over their own data.
Strengths
The standard privacy lens; aligns with GDPR / regulatory framing.
Trade-offs
Privacy-focused; does not cover non-privacy threats.
Best fit
Systems handling personal data; regulated industries.
Composes
Helmwart surfaces a LINDDUN callout in Q2 when industry / sensitivity flags indicate personal or regulated data.
AI variant
LINDDUN-AI (emerging): Community work to extend each LINDDUN category with AI-specific failure modes (model inversion, training data linkability). Not a single formal release.
Purpose-built for agentic AI; layer model admits cross-layer threats; explicitly extends STRIDE / PASTA / LINDDUN / VAST.
Trade-offs
Layer model can feel abstract on small systems.
Best fit
Agentic systems of any size.
Composes
Helmwart's Q2 primary enumeration lens. Layers L1–L7 + CL are catalogued at /atlas/references/#maestro.
OWASP MAS Threat Modelling Guide v1.0
OWASP GenAI Security Project, April 2025
What
Companion multi-agent modelling guide. It walks three worked systems (RPA expense, ElizaOS, Anthropic MCP) through MAESTRO and reuses some identifiers for system-specific variants. Helmwart creates stable navigation entries and labels the renumbered RPA T16/T17 entries as T48/T49 alongside the later v1.1 base catalog.
Strengths
Concrete worked examples; explicit cross-layer scenario tables.
Trade-offs
Older than the v1.1 OWASP Agentic AI catalog (Dec 2025); its scenario-scoped numbering cannot be treated as a single globally unique catalog without normalization.
Best fit
The most direct reference for any threat model of a multi-agent system.
Composes
Helmwart normalizes MAS Guide scenario threats into T18–T49. The wizard's Q2 surfaces them automatically when their editorially linked base T1–T17 threat is selected.
OWASP Top 10 for Agentic Applications 2026
OWASP GenAI Security Project
What
Practitioner top-10 catalog (ASI01–ASI10) with OWASP mappings to the base threat taxonomy and the OWASP LLM Top 10; Helmwart adds editorial links to MAS-derived entries.
Strengths
The format security GRC readers recognise.
Trade-offs
Top-10 by design; not the full catalog.
Best fit
Briefing non-architects.
Composes
Catalogued at /atlas/references/#asi-top10.
MITRE ATLAS
MITRE
What
Adversarial Tactics, Techniques, and Common Knowledge for ML (AML.T#### IDs).
Strengths
The adversary-TTP knowledge base; ATT&CK's sibling for AI.
Trade-offs
A reference catalogue, not a methodology. Use it alongside a methodology.
Best fit
Q2 pivot from "what's the risk" to "what's the attacker actually doing".
Composes
Helmwart surfaces ATLAS chips on every threat where a clean technique mapping exists.
NIST AI RMF (AI 100-1)
NIST, Jan 2023
What
Govern / Map / Measure / Manage functions for AI risk; stop-build authority; third-party oversight.
Strengths
Governance backbone; widely adopted by regulators.
Trade-offs
High-level; needs a technical methodology underneath.
Best fit
Q4 governance scaffold.
Composes
Helmwart's Q4 surfaces a four-row Govern/Map/Measure/Manage prompt set drawn from AI 100-1 + AI 600-1.
NIST AI 600-1: GenAI Profile
NIST, Jul 2024
What
Twelve GAI risk categories (Confabulation, Information Integrity, Information Security, Value Chain Integration, …), each with Govern/Map/Measure/Manage actions.
Strengths
Standards-grounded cross-walk for hallucination, supply-chain, memory, and output-moderation controls.
Trade-offs
Companion to AI 100-1, not a standalone methodology.
Best fit
Anchoring Q4 prompts to a formal risk category set.
Composes
Cited inline on the Q4 NIST AI RMF mini-checklist.
STRIFE
Aviatrix, 2026
What
Newer alternative framework discussed in vendor write-ups.
Strengths
Recent.
Trade-offs
Less established than STRIDE or MAESTRO; limited tooling.
Four Questions as the scaffold. Microsoft Threat Modeling Tool, IriusRisk, Snyk Labs, and several recent papers all frame their workflows in Shostack's four questions. Using the same shape lets the wizard sit alongside familiar tooling without asking the reader to re-learn a process.
OWASP v1.1 + MAESTRO / MAS Guide + ATLAS as Q2 lenses. The v1.1 publication supplies the base T1–T17 taxonomy; the MAS Guide applies MAESTRO to three worked multi-agent systems; ATLAS provides an adversary-technique pivot. Helmwart combines these as base threats, normalized MAS scenario entries, architectural layers, and TTP links.
Deterministic, not LLM-generated. The same answers always produce the same output. No API key needed; no model output variance; works in a static-site browser tab. STRIDE-GPT, MAESTRO Playbook, ASTRIDE, and Trent AI are all LLM-driven; worth pairing with, not replacing.
Diagram-first. The canvas at /canvas/ is the architectural source of truth. Findings emerge from the graph rather than a checklist. The workflow page is the on-ramp for users who want a guided pass before they sit with the canvas.
Open source. No vendor lock-in. ThreatModeler + IriusRisk and SD Elements are excellent at enterprise scale; Helmwart sits in the gap below them.