TLDR: ThreatGPT is an Agentic AI framework that simplifies threat modeling for public safety systems. Developed by Sharif Noor Zisad and Ragib Hasan, it allows users, even without deep cybersecurity expertise, to describe a system and generate comprehensive threat models using established frameworks like STRIDE and MITRE ATT&CK. By leveraging few-shot learning and the Gemini API, ThreatGPT significantly reduces the time required for threat analysis from hours to seconds, making proactive security more accessible and efficient for critical infrastructure and enhancing public safety.
As our cities become increasingly smart and interconnected, the systems that underpin public safety—like traffic control, emergency response, and public transportation—grow in complexity. While these advancements bring convenience, they also introduce new vulnerabilities to security threats that can impact not just technology, but real human lives.
Addressing this critical challenge, researchers Sharif Noor Zisad and Ragib Hasan from the University of Alabama at Birmingham have introduced ThreatGPT, an innovative Agentic Artificial Intelligence (AI) assistant. This framework is designed to empower a wide range of users, from engineers and safety officers to policymakers, to understand and analyze potential threats within public safety systems without needing deep cybersecurity expertise.
Traditional threat modeling, the process of identifying and understanding security problems before they occur, is often complex, technical, and time-consuming. It typically requires specialized knowledge to apply frameworks like STRIDE, MITRE ATT&CK, CVE reports, NIST guidelines, or CISA threat reports effectively. ThreatGPT aims to democratize this process.
How ThreatGPT Works
ThreatGPT stands out because it acts as a knowledgeable partner rather than just a tool. Users can simply describe the components of a system they are concerned about—such as login systems, data storage, or communication networks. With a simple interaction, ThreatGPT can then analyze these components using popular cybersecurity frameworks chosen by the user.
The core of ThreatGPT lies in its Agentic AI capabilities. Unlike conventional AI that merely responds to commands, Agentic AI can take initiative, ask clarifying questions, guide users, and adapt based on context. This means ThreatGPT doesn’t just provide information; it walks users through the entire threat modeling process, suggesting next steps, clarifying missing details, and ensuring comprehensive coverage.
Key characteristics of this Agentic AI include:
-
Goal-driven: It proactively works towards generating a complete threat model.
-
Planning and Reasoning: It creates multi-step plans, logically reasoning through the problem.
-
Autonomy: It operates independently, managing sub-tasks and resolving issues.
-
Adaptability: It modifies its strategies based on new information or changing circumstances.
-
Memory and State: It remembers past interactions to inform future behavior, building context over time.
To achieve its intelligent analysis, ThreatGPT was trained using a few-shot learning approach, incorporating over 50 detailed examples of threat models based on established frameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege), MITRE ATT&CK, CVEs (Common Vulnerabilities and Exposures), NIST (National Institute of Standards and Technology), CISA (Cybersecurity and Infrastructure Security Agency) reports, and NVD (National Vulnerability Database). This extensive training, powered by the Google Gemini API, enables the AI to understand cybersecurity terminology, threat categories, and real-world scenarios, leading to accurate and context-specific responses.
Also Read:
- BinaryShield: Protecting AI Services with Privacy-Preserving Attack Fingerprints
- Neuro-Symbolic AI: Bridging Intelligence Gaps in Cybersecurity
A Faster, Smarter Approach to Security
The system’s workflow is designed for efficiency. When a user requests a threat model, ThreatGPT identifies its goal, develops a multi-step plan (including asset identification, entry point analysis, threat mapping, vulnerability assessment, and mitigation suggestions), generates an initial draft, and then performs self-verification. If any gaps are detected, it autonomously formulates clarification questions for the user, refining the model as new information is received. The final output is a polished, comprehensive, and professionally structured threat model.
Experiments conducted by the researchers demonstrated a significant reduction in the time required for threat model generation. While human experts typically spend over 40 hours creating a threat model for a specific system, ThreatGPT can accomplish the task in approximately 30 seconds. This rapid response capability is crucial for public safety, where timely identification and mitigation of threats are essential for protecting critical infrastructure and ensuring community security.
ThreatGPT represents a significant step forward in making high-quality threat analysis accessible and efficient for diverse stakeholders. By combining generative AI with proven cybersecurity knowledge, it empowers individuals to proactively identify risks and strengthen system resilience, ultimately contributing to safer public systems.
For more in-depth information, you can read the full research paper: ThreatGPT: An Agentic AI Framework for Enhancing Public Safety through Threat Modeling.
