The use of generative AI technologies in architectural threat modeling automation seems to be a promising alternative to ‘traditional’ formal approaches (e.g., attack-defense trees, domain-specific languages, knowledge graphs, etc.). The main advantage of Large Language Models (LLMs) is that they can work with system and threat descriptions in textual form, skipping the formalization stage required for traditional frameworks. The work considers how by leveraging local LLMs (i.e., running on enterprise hardware) to overcome the data privacy and regulatory compliance risks associated with feeding proprietary data into online AI systems. Threat modeling was performed via the free Gemma 4 model family on a dataset containing 200 descriptions of containerized applications, and results were compared with those from a formal ontology-driven framework. The case study demonstrates that local LLMs can serve as replacements for formal systems when matching and reproducing text-based threat modeling rules. The models with 26 and 31 billion (B) parameters can provide adequate metrics (up to 0.975 precision and 0.981 recall for advanced threat models by the 31B LLM with thinking enabled). However, generative AI cannot guarantee metrics as repeatable as those produced by 'strict' automated cybersecurity analysis systems, and it also requires extra computational power for local use to provide rapid threat modeling.
Brazhuk, A. Automatic analysis of containerized application deployment models based on ontologies and knowledge graphs. Int. J. Open Inf. Technol. 2025, 13, 105–111.
Brazhuk, A.I.; Olizarovich, E.V. Ontological analysis in the problems of container applications threat modelling. Informatics 2023, 20, 69–86. (In Russian)
Xiong, W.; Lagerström, R. Threat modeling–A systematic literature review. Comput. Secur. 2019, 84, 53–69.
Tran, A.D.; Verreydt, S.; Yskout, K.; Joosen, W. A Multivocal Literature Review on the Effectiveness of Security Threat Modeling. IEEE Trans. Softw. Eng. 2026, 52, 1352–1370.
Broccia, G.; Ter Beek, M.H.; Lafuente, A.L.; Spoletini, P.; Fantechi, A.; Ferrari, A. Evaluating the understandability and user acceptance of Attack-Defense Trees: Original experiment and replication. Inf. Softw. Technol. 2025, 178, 107624.
Berger, B.J.; Plump, C. Automatic security-flaw detection-towards a fair evaluation and comparison. Softw. Syst. Model. 2025, 24, 1763–1796.
Engström, V.; Nebbione, G.; Ekstedt, M. Modeling and Simulating Cyberattacks with the Dynamic Meta Attack Language. SSRN 2025, 5462920 (preprint).
Rouland, Q.; Adi, K.; Timo, O.N.; Logrippo, L. A Formal Approach for Security Pattern Enforcement in Software Architecture. Comput. Secur. 2025, 162, 104749.
Chiş, A.; Stoica, O.I.; Ghiran, A.M.; Buchmann, R.A. A knowledge graph approach to cyber threat mitigation derived from data flow diagrams. In Proceedings of the 2024 IEEE International Conference on Automation, Quality and Testing, Robotics (AQTR), Cluj-Napoca, Romania, 16–18 May 2024.
Zhang, J.; Bu, H.; Wen, H.; Liu, Y.; Fei, H.; Xi, R.; et al. When LLMs meet cybersecurity: A systematic literature review. Cybersecurity 2025, 8, 55.
Yigit, Y.; Buchanan, W.J.; Tehrani, M.G.; Maglaras, L. Review of generative AI methods in cybersecurity. Internet Things Cyber-Phys. Syst. 2026, 5, 241–261.
Kaheh, M.; Kholgh, D.K.; Kostakos, P. Cyber sentinel: Exploring conversational agents in streamlining security tasks with GPT-4. arXiv 2023, arXiv:2309.16422 (preprint).
Wu, T.; Yang, S.; Liu, S.; Nguyen, D.; Jang, S.; Abuadbba, A. ThreatModeling-LLM: Automating threat modeling using large language models for banking system. arXiv 2024, arXiv:2411.17058 (preprint).
Elsharef, I.; Zeng, Z.; Gu, Z. Facilitating threat modeling by leveraging large language models. In Proceedings of the Workshop on AI Systems with Confidential Computing, San Diego, CA, USA, 26 February 2024.
Salek, M.S.; Chowdhury, M.; Munir, M.B.; Cai, Y.; Hasan, M.I.; Tine, J.M.; et al. A large language model-supported threat modeling framework for transportation cyber-physical systems. IEEE Access 2025, 13, 163046–163070.
Sammouri, K.; Walden, J. A large language model based threat modeling tool with CAPEC semantic retrieval. SSRN 2025, 5242954 (preprint).
Mbaka, W.B.; Tuma, K. Less is more: usefulness of data flow diagrams and large language models for security threat validation. Empir. Softw. Eng. 2026, 31, 122.
Bissoli, A.; Mollaeefar, M.; Van Landuyt, D.; Ranise, S. Benchmarking the effectiveness of multi-agent LLMs in collaborative privacy threat modeling with LINDDUN GO. J. Inf. Secur. Appl. 2026, 100, 104489.
