We need to generate a threat model for a new service. Is there an AI that can analyze our architecture diagram and identify potential security threat vectors?

Yes. There are now several tools specifically designed to turn an architecture diagram into a threat model rather than just asking a general-purpose LLM to “find vulnerabilities.”

Strong options

• iriusrisk.com — Probably the most mature fit if you want an actual threat-modeling platform. Its Jeff AI can take images/text and generate a threat model with threats and security controls. It also supports importing diagrams and IaC.
• threatmodeler.ai — Particularly interesting for larger engineering/security organizations. Its System Mapping Agent can ingest architecture diagrams, Terraform, code, APIs, cloud environments, and documents, then build an architecture-aware model. ThreatModeler launched its Nexus platform in June 2026.
• threatvector.ai — More diagram-centric and AI-native. Its SAI analyzes components and data flows, performs STRIDE/OWASP-based threat detection, identifies attack paths, and recommends mitigations.
• github.com — Worth looking at if keeping architecture data private is important. It's an open-source, offline-first application that can use local LLMs through Ollama and maps analysis to MITRE ATT&CK/NIST.
• docs.convisoappsec.com — Its AppSec AI Agent can generate a threat-modeling artifact from PNG/JPEG/PDF and other architecture inputs.

What I'd recommend

If you already have an architecture diagram, I'd evaluate IriusRisk and ThreatModeler first. They are closer to threat-modeling systems than generic AI image analyzers.

For example, a good analysis should turn something like:

Internet → CDN/WAF → API Gateway → microservices → PostgreSQL ↘ S3 ↘ third-party payment API into findings such as:

• Internet-facing attack surfaces
• Trust-boundary crossings
• Authentication/authorization weaknesses
• SSRF opportunities
• Service-to-service privilege escalation
• Inadequate tenant isolation
• Database exposure
• Secrets-management risks
• S3 bucket/data-exfiltration paths
• Third-party integration risks
• Missing encryption or integrity controls
• Abuse cases and denial-of-service paths

And ideally it should give you threat → affected component/data flow → attack scenario → severity → mitigation → framework mapping, rather than simply producing a list of generic security concerns.

One important caveat: don't treat an AI-generated threat model as the final security review. Diagram interpretation can miss things that aren't visible in the architecture—actual IAM policies, network rules, API behavior, data sensitivity, deployment configuration, etc. Microsoft’s conventional Threat Modeling Tool, for example, explicitly centers the process around identifying the system/data flows, trust boundaries, threats, and mitigations.

If you upload your architecture diagram here, I can also analyze it directly and produce a structured threat model—e.g. STRIDE + attack paths + trust boundaries + prioritized mitigations—without requiring you to adopt one of these platforms.

Yes, modern multimodal AI models and specialized security tools can analyze architecture diagrams to identify trust boundaries, data flows, and potential security threat vectors using frameworks like STRIDE.

Available AI Tools and Solutions

• AWS Threat Designer : A serverless web solution that uses large language models and multimodal AI to process uploaded system architecture diagrams, map component relationships, and generate an interactive threat catalog.
• Apiiro Guardian Agent : An automated platform that accepts on-demand uploads of design specifications, architectural diagrams, or whiteboard photos to instantly generate contextual threat models.
• Multimodal Foundation Models (e.g., Google Gemini or OpenAI GPT-4o) : General-purpose multimodal models can ingest image files or exported PDFs of architecture diagrams directly when paired with a structured prompt asking them to act as a security architect and apply the STRIDE methodology (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege).

Comparison of AI Approaches

If you'd like, let me know:

• What file format your diagram is in (PNG, draw.io, Lucidchart, PDF)
• Whether you prefer an ad-hoc AI prompt approach or a dedicated security platform

I can give you a custom prompt template to feed your diagram into an AI model securely.

Yes, several tools and AI-driven approaches can analyze architecture diagrams (or system descriptions) and map out potential threat vectors using frameworks like STRIDE or OWASP.

Enterprise platforms, dedicated open-source tools, and general multimodal LLMs can handle this task, depending on your privacy requirements and workflow.

1. Dedicated & Enterprise Threat Modeling Platforms (With AI)

• IriusRisk: An enterprise-grade threat modeling platform that features Jeff AI . You can upload images/diagrams or describe your system, and the platform translates it into components, identifies risks, and suggests countermeasures.
• Custom/Internal Enterprise Tools: Many tech companies build internal agents (e.g., CRED’s ThreadSeal or AWS-based multi-agent architectures like Threat Designer ) that take an architecture diagram image, run it through vision-enabled LLMs (like Claude 3.7 or GPT-4o) to detect trust boundaries and data flows, and output a structured STRIDE analysis.

2. Open-Source and Community AI Tools

• STRIDE GPT: A popular community/open-source AI-powered tool that uses major LLM providers to generate detailed threat models. While it primarily runs on structured text/application descriptions rather than a direct image upload of a diagram, you can use it to systematically break down components by Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
• Custom LLM Workflows (e.g., Claude or ChatGPT Plus): If your data privacy policies allow uploading your diagram to a commercial LLM:
  • How to do it: Export your architecture diagram as an image or PDF (make sure to scrub internal hostnames, credentials, or sensitive IP info).
  • The Prompt: Feed it to a multimodal model like Claude 3.5 Sonnet or GPT-4o with a prompt like: "Act as an application security architect. Analyze this architecture diagram. Identify all data flows, trust boundaries, and external entry points. Then, perform a STRIDE threat model analysis on each component and output a prioritized list of potential threat vectors and mitigations."

Key Considerations Before Using AI for Threat Modeling

• Data Privacy: Avoid uploading raw diagrams containing production IP addresses, internal domain names, or proprietary credentials to public cloud AI endpoints. Opt for enterprise-tier APIs with zero-data-retention policies or air-gapped local models if your design is highly confidential.
• Hallucinations & Blind Spots: AI is a fantastic force multiplier and can catch standard web/cloud blind spots quickly, but it lacks deep context about your specific business logic. Always treat the AI's output as a first-pass draft that requires human security review.

If you'd like to share:

• What format your diagram is in (PNG/PDF, Lucidchart/Visio , or Code/IaC like Terraform)
• Whether you have strict data privacy constraints preventing public AI usage

I can recommend the safest way to execute this or help you write a structured prompt to analyze a scrubbed version of your diagram right now.

Yes. There are now several tools specifically aimed at AI-assisted threat modeling from architecture diagrams, rather than just asking a general-purpose LLM to inspect a picture.

Best options

• iriusrisk.com — probably the closest match to what you're describing. Jeff can take architecture images/diagrams and turn them into a threat model, including threats and security controls. It can also ingest documentation, source code, SBOMs, and other design artifacts.
• threatmodeler.ai — more enterprise-oriented. Its System Mapping Agent can interpret architecture diagrams, IaC, code, cloud environments, and documents, then map them into a threat model. It emphasizes keeping the model tied to the actual architecture rather than producing a one-off LLM response.
• learn.microsoft.com — not really AI-first, but a useful established option. You model the architecture as a data-flow diagram and it automatically analyzes it using STRIDE and suggests mitigations.

What I'd recommend

If you already have an architecture diagram, I'd start with IriusRisk/Jeff or ThreatModeler Nexus. They are designed around the workflow:

architecture → components/data flows/trust boundaries → threats → mitigations → review

That's substantially better than simply uploading the diagram to ChatGPT and asking "find security issues." A general LLM can produce useful hypotheses, but it can miss implicit trust boundaries and tends to produce generic STRIDE checklists. IriusRisk, for example, uses the AI to help construct the representation and then applies its threat-modeling/rules engine to generate threats and countermeasures, giving you traceability for why a threat was identified.

If your service includes LLMs, agents, RAG, tool calling, or model-serving infrastructure, I'd give extra consideration to ThreatModeler because it explicitly covers AI/ML-specific architecture and threats such as prompt injection and model manipulation.

One important caveat

Don't treat the generated model as the security review itself. The AI should produce a first-pass threat inventory that a security/architecture reviewer validates, particularly around:

• trust boundaries and authentication/authorization
• sensitive data flows
• externally reachable components
• service-to-service privileges
• secrets and key management
• tenant isolation
• supply-chain dependencies
• logging/audit gaps
• abuse cases and DoS
• cloud IAM and network controls

If you have the architecture diagram, you can upload it here and I can perform a structured threat-model review as well—e.g. STRIDE + attack paths + trust-boundary analysis + prioritized mitigations.

If your service includes LLMs, agents, RAG, tool calling, or model-serving infrastructure, I'd give extra consideration to ThreatModeler because it explicitly covers AI/ML-specific architecture and threats such as prompt injection and model manipulation.

One important caveat

Yes, absolutely. Several modern tools and multimodal AI configurations can analyze architecture diagrams, parse components/data flows, and systematically enumerate threat vectors (typically using frameworks like STRIDE).

Options range from specialized enterprise platforms to developer-focused tools and multi-modal foundational models:

• Dedicated AI Threat Modeling Platforms: Tools like IriusRisk (featuring their "Jeff" AI agent) and ThreatModeler use system-mapping AI agents to ingest architecture diagrams, cloud setups, or Infrastructure-as-Code (IaC) and draft comprehensive threat models. Another enterprise player, Apiiro , uses an AI guardian agent to correlate architecture and code layers.
• Diagramming & Design Tools with AI: Platforms like Eraser.io allow you to create or generate system design diagrams-as-code and leverage built-in AI capabilities to evaluate potential risks and produce architectural threat models.
• Open-Source & Community Tools: Projects like STRIDE GPT let you upload diagrams (or use an embedded diagrams.net editor to parse XML/images) to run structured STRIDE analyses via large language models.
• Multimodal Foundation Models (e.g., Claude, Gemini, GPT-4o): If privacy policies permit uploading your diagram to a secure enterprise instance, you can feed an image or export of your architecture diagram directly to a vision-capable LLM. By prompting it to act as a Principal Application Security Architect , you can instruct it to dissect the boxes, lines, and trust boundaries using the STRIDE methodology.

If you'd like to share what format your diagram is in (PNG/PDF, draw.io/Lucidchart, or IaC/Terraform) and what cloud provider or stack you are using, I can help you pick the best tool or draft a specialized prompt for an initial analysis.

Yes. There are now several tools specifically designed to take an architecture diagram (or architecture/IaC) and turn it into a threat model.

Best options

IriusRisk's Jeff is probably the closest match to exactly what you're describing. It can take images as input and generate a threat-model representation, including associated risks and controls. Its approach is interesting because the AI creates the architecture representation, after which IriusRisk's rules engine deterministically maps threats and countermeasures rather than relying entirely on an LLM's judgment.

AWS Threat Designer is particularly interesting if you want something you can experiment with yourself. The AWS Labs project accepts up to three architecture diagrams, generates STRIDE-based models, supports iterative refinement, and has a CLI that can run using your existing Bedrock or OpenAI credentials.

ThreatModeler Nexus is the more enterprise/continuous option. Its current platform uses agents to turn diagrams, IaC, and cloud information into a system map, then maps threats and controls against it.

One important caveat

I wouldn't treat "upload architecture diagram → ask an LLM for threats" as the final threat model.

A diagram often doesn't tell the model things that materially change the threat landscape:

• authentication/authorization semantics
• exact trust boundaries
• data classification
• internet vs internal exposure
• tenant isolation
• privileged service identities
• third-party dependencies
• failure/retry behavior
• secrets management
• deployment/IaC configuration
• abuse cases and business logic

The strongest workflow is therefore:

Architecture diagram → AI extracts components/data flows → STRIDE/other threat analysis → human security review → mitigations mapped back to architecture.

Microsoft's traditional Threat Modeling Tool follows this architecture-first philosophy and can analyze a model for potential security issues and suggested mitigations.

If you have the architecture diagram already, you can upload it here. I can analyze it and produce a structured threat model covering trust boundaries, attack surfaces, STRIDE threats, likely attack paths, severity, mitigations, and questions/unknowns.

Yes, multimodal AI models and specialized security platforms can analyze architecture diagram images or design specifications to automatically enumerate threat vectors using frameworks like STRIDE . Dedicated security tooling and advanced LLMs allow you to upload or parse diagrams to jumpstart your threat modeling process.

Dedicated Tools with AI Diagram Analysis

• IriusRisk (with Jeff AI) : Allows you to upload image files or system diagrams so its AI assistant can help draft components, data flows, and map out structured risk analysis.
• Apiiro Guardian Agent : Supports on-demand analysis where you can upload design documents, whiteboard snapshots, or architectural schemas to generate contextual threat models.
• Security Compass (Devici) : Employs a diagram-first user experience that models complex data flows, dependencies, and cloud environments to build an automated threat register.

General-Purpose Multimodal LLMs

• Claude (Anthropic) : Strong performance in parsing uploaded image screenshots of data flow or network diagrams, extracting components, and categorizing threats by severity using standard security frameworks.
• ChatGPT / GPT-4o (OpenAI) : Can interpret architectural images or descriptive text, output structured threat matrices (e.g., mapping components to STRIDE), and suggest hardening mitigations.
• Gemini (Google Cloud) : Leverages advanced computer vision capabilities to interpret system topology from pictures and systematically enumerate trust boundaries and data-flow risks.

If you'd like, I can help you write a comprehensive prompt optimized for a multimodal LLM if you describe the core components (e.g., API Gateway, Auth provider, Database) and primary data flows of your service.

Yes. There are now purpose-built AI-assisted threat-modeling tools that can take an architecture diagram and turn it into a threat model rather than just having a general-purpose LLM “look at the picture.”

Best options

• IriusRisk / Jeff AI — probably the closest match to what you're describing. Jeff can take architecture images/diagrams, documentation, user stories, meeting transcripts, or code and generate a threat-model representation. IriusRisk then applies its rules engine to identify threats and recommended security controls.
• ThreatModeler Nexus — more enterprise-oriented. It can import diagrams, documentation, IaC and cloud context, map them into a system model, and use specialized agents to identify threats. It emphasizes traceability and governance rather than simply producing an LLM-generated list.
• Microsoft Threat Modeling Tool — a mature, non-AI option. You construct a data-flow diagram, establish trust boundaries, and analyze it against Microsoft's threat-modeling methodology. It's useful as a deterministic second opinion.

What I'd recommend

If your starting point is literally “here's our architecture diagram; find the security threat vectors,” I'd start with IriusRisk. Its current AI workflow specifically supports image uploads and then separates the AI-assisted architecture interpretation from the deterministic threat/controls analysis.

That's preferable to simply uploading the diagram to ChatGPT/Claude/Gemini and asking “what are the threats?” A general LLM can produce useful brainstorming, but it can miss trust boundaries, make assumptions about components, and produce an inconsistent threat model. IriusRisk explicitly notes this distinction: its AI creates the system representation, while its rules engine generates the threats and countermeasures with traceability.

A good workflow would be:

Architecture diagram → AI extracts components/data flows/trust boundaries → STRIDE + architecture-specific threats → mitigations/controls → human security review

And don't stop at STRIDE. For a modern service I'd want the analysis to cover things like:

• Authentication/authorization and privilege escalation
• Internet-facing attack surface
• Trust-boundary crossings
• API abuse and injection
• Secrets/credential exposure
• Data exfiltration and sensitive-data flows
• SSRF and cloud metadata access
• Service-to-service impersonation
• Supply-chain/dependency risks
• Logging/monitoring gaps
• DoS/resource exhaustion
• Tenant isolation, if multi-tenant
• CI/CD and infrastructure compromise
• Cloud IAM and overly broad permissions
• AI/LLM-specific threats, if applicable

If you upload your architecture diagram here, I can also analyze it directly and produce a structured threat model—components, trust boundaries, attack vectors, severity, likely attack paths, and recommended mitigations.

Yes. There are now tools that can get fairly close to what you're describing: ingest an architecture/DFD, identify components and trust boundaries, then generate a threat model and mitigations.

Best options

1. ThreatModeler Nexus — probably the closest fit to your requirement. Its current platform can ingest diagrams, documents, infrastructure-as-code, and cloud context, then use agents to create a system map and threat model. www.threatmodeler.ai
   Best for: enterprise teams wanting automated/continuous threat modeling rather than a one-off AI analysis.

2. Microsoft Threat Modeling Tool — a more traditional, deterministic approach. You model the architecture as a data-flow diagram and it performs STRIDE-based analysis, generating threats and suggested mitigations. learn.microsoft.com
   Best for: teams that want a well-established methodology and don't necessarily need generative AI.

3. An LLM/vision model — you can give a capable multimodal model your architecture diagram and ask it to reconstruct the DFD, identify trust boundaries, enumerate STRIDE threats, and produce attack paths. Research systems such as Auspex are specifically exploring this architecture → threat-matrix workflow. arxiv.org
   Best for: quickly getting a first-pass analysis, especially when the architecture isn't already represented in a threat-modeling tool.

What I'd recommend

For a new service, I'd use AI as the first-pass analyst, not as the final authority:

Architecture diagram → AI decomposition → trust boundaries → assets/data flows → STRIDE → attack paths → mitigations → human security review

That's important because an image alone often doesn't tell the model things such as:

• whether an API requires authentication
• what IAM role a service actually has
• whether traffic is encrypted
• what data is considered sensitive
• whether a third-party service is trusted
• what happens after a component is compromised
• whether an internal network boundary is actually a security boundary

Microsoft's own methodology explicitly treats threat modeling as a process of diagram → identify threats → mitigate → validate, rather than simply running a diagram through a scanner.

If you have the architecture diagram, you can upload it here. I can analyze it directly and produce a practical threat model covering trust boundaries, assets, entry points, STRIDE threats, likely attack paths, severity, and recommended mitigations. That can be a good way to determine whether you even need a dedicated commercial tool.

Yes, several platforms and multimodal AI setups can analyze architecture diagrams (as images, exports, or code definitions) and map out potential threat vectors using frameworks like STRIDE.

Options range from dedicated security platforms to open-source or commercial AI tools:

• IriusRisk (with its AI assistant, Jeff): An enterprise heavyweight for threat modeling. It allows you to upload diagram images or provide architectural descriptions, using its rule engine to automatically generate threats and countermeasures.
• Threat Designer (AWS Labs) : An open-source, serverless web application provided via AWS Samples on GitHub that uses multimodal LLMs (like Claude via Amazon Bedrock) to process uploaded architecture diagrams, identify trust boundaries, and build a threat catalog.
• ThreatCanvas (SecureFlag) : A specialized utility designed to ingest diagrams (PNG, JPEG, SVG, Visio, Draw.io) or Infrastructure-as-Code (Terraform, YAML), extracting entities and data flows to map threats against frameworks like STRIDE or PCI DSS.
• General Multimodal LLMs (Claude 3.5 Sonnet / GPT-4o / Gemini 1.5 Pro) : If you don't mind a DIY approach, you can upload your architecture diagram directly into a capable multimodal LLM. Prompt it to act as an expert Application Security Architect, apply the STRIDE or LINDDUN framework, and explicitly map out entry points, trust boundaries, and concrete attack vectors. (Note: Ensure you sanitize proprietary details or use enterprise/zero-retention tiers if uploading sensitive internal schematics).

If you'd like, share:

• What cloud provider or tech stack your service uses (AWS, Azure, Kubernetes, etc.)
• Whether you prefer an automated SaaS tool or a prompt template to run it through a standard LLM

I can give you a tailored prompt or recommend the best integration for your workflow.