Ansvar AI docs
    ansvar.eu →

    Threat modeling

    A STRIDE-driven security threat model for a system you describe to the agent. The workflow walks scoping and DFD construction → six-way STRIDE specialist analysis over the diagram → review → enrichment and scoring → mitigation → report, grounding the enrichment in the gateway's threat-framework corpora. The product overview, including the OT and drone STRIDE variants, is on the threat-model family page.

    Tier

    Every plan. Free runs 1 STRIDE threat model a month and Solo runs 2, both on a system you describe, using the full workflow lifecycle (start_workflow, submit_response, generate_report, plus the create_dfd and recommend_subagents specialists). At those two plans the report arrives as a watermarked rendered document or structured JSON, the run grounds its enrichment at the plan's own search scope, and the allowance is a hard stop — no overage.

    Premium raises the allowance to 5 runs a month and widens what a run can do: the LINDDUN privacy and TARA risk families, and case law and agency guidance pulled into the enrichment passes, cited verbatim — with the report as structured JSON (rendered exports are not part of Premium). Team raises the quota to 20 runs per seat a month and adds document grounding — evidence from your own uploaded architecture docs — plus unwatermarked HTML, PDF and DOCX renders. The threat-pattern lookups (search with sources=['threat-frameworks']) and the CVE tools (search_cve and friends) are available for briefs without the workflow. Public CVE details, KEV status, EPSS scores, known exploits, product search, and feed freshness remain on Free; CAPEC, CWE, and D3FEND enrichment starts at Premium. Team adds effective-risk rescoring against customer asset context, review decisions, and OpenVEX export.

    What you ask the agent

    Using Ansvar: run a threat model for our payments service.
It's a Go API behind nginx, talking to Postgres and Stripe,
with OAuth-authenticated customer clients and a Keycloak IdP.

    The agent calls start_workflow(workflow_type="threat_model") and guides the rest from there.

    Stages

    1. Scoping & DFD — system description and key assets, a scope check, then data-flow-diagram construction: the agent extracts components, data flows, trust zones, and assets, validates the graph with create_dfd, and shows you the rendered Mermaid diagram for review before analysis starts. On Team and Company, architecture diagrams and design docs go in via register_document; on Free, Solo and Premium, you describe the system in the conversation instead.
    2. Document collection (Team+) — supporting evidence: existing security controls, network diagrams, IAM policies. Runs on Free, Solo and Premium skip this stage and work from the described system.
    3. STRIDE analysis — one dispatch step that fans out six STRIDE-category specialists (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) over the reviewed DFD — in parallel where the client supports subagents, sequentially elsewhere — and merges their threat lists into one register with a coverage matrix.
    4. Threat review — user-reviewed threat register before enrichment.
    5. Threat enrichment & scoring — adds attack-chain references and related patterns from the framework corpora via search (MITRE ATT&CK and ATLAS on every plan; CAPEC, CWE and D3FEND on Premium and above), then scores severity and likelihood per threat.
    6. Mitigation — for each high-priority threat, one or more proposed mitigations with cited control sources (NIST, ISO, sector frameworks where the agent has them in scope).
    7. Report — generate_report(workflow_id) assembles the threat-model document. The structured threat list is also retrievable via get_workflow_threats(workflow_id) for programmatic downstream use.

    What you get back

    A structured threat model: system scope, components with type and technology, threat register with STRIDE category, severity, likelihood, and mitigation. Each factual finding carries a served evidence reference or an unresolved marker. The threat list is queryable independently of the prose report — useful if you want to roll the findings into a ticketing system.