Course description
Threat Modeling AI Agents and LLM Applications teaches the people who build and secure agents to find design flaws before launch. You will learn what LLM applications and agents add to the attack surface, draw data-flow diagrams that label who controls the content of every flow and which identity every tool call uses, and find threats with STRIDE, the OWASP Top 10 for LLM Applications 2025, OWASP's agentic threat guidance (T1 to T17 and ASI01 to ASI10) and MITRE ATLAS. A full section covers the confused deputy, an agent misusing its own legitimate privileges, and the design patterns that remove it. In five labs you write a threat model as code with OWASP pytm, inventory the untrusted inputs and privileged actions of a fictional inbox-to-CRM agent, prove a confused-deputy control with a canary test, and complete a threat register that a script checks. The course ends with a threat model for an agent your organization runs or plans. Last verified 2026-11-03.
About this course
An agent that reads email, tickets or documents and can update records or send messages acts with whatever authority its tools hold, for whoever manages to put text in front of it. This course teaches security engineers, AppSec and platform teams, ML engineers and security leaders to threat model LLM applications and tool-using agents before launch. You will map the attack surface with data-flow diagrams and trust boundaries, find threats with STRIDE and the catalogues from the OWASP Top 10 for LLM Applications 2025 and OWASP's agentic threat guidance, map them to MITRE ATLAS, and design out the confused deputy. Every threat ends with a control enforced outside the model, a verification test and a monitoring signal. Labs use OWASP pytm and pytest on a fictional inbox-to-CRM agent, with synthetic records and a harmless canary string. The method is vendor-neutral; where a control is a platform setting on ibl.ai, the course links the live documentation.
What you will be able to do
- Describe what LLM applications and tool-using agents add to the attack surface, and state each threat with the attacker's goal, preconditions and evidence using the NIST AI 100-2e2025 taxonomy.
- Draw a data-flow diagram with trust boundaries for an agent, labeling every flow with who controls its content and every tool call with the identity it uses, by hand or as code with OWASP pytm.
- Find threats systematically by walking each element against STRIDE, the OWASP Top 10 for LLM Applications 2025 and OWASP's agentic threat guidance, and map each one to MITRE ATLAS techniques.
- Recognize the confused deputy, an agent misusing its own legitimate privileges for someone who lacks them, and design it out with run-as-requester, identity from trusted context, per-action policy and bound human approval.
- Assign every threat a control enforced outside the model and a verification test that can fail, using synthetic data and a harmless canary on systems you own.
- Keep a threat model current with monitoring signals, switch-off criteria, review triggers and a threat register a reviewer can check, aligned with the NIST AI RMF and NIST AI 600-1.
Who this course is for
Roles: security engineers, application security and platform teams, ML and AI engineers who build agents, security architects, and security leaders who approve agent launches.
Organizations: any sector building, buying or operating LLM applications or agents connected to email, ticketing, CRM, code repositories, payments or other systems of record.
Before you start: familiarity with application security and access control. The labs need Python 3.11 to 3.14 (the course used 3.12) and a terminal; Graphviz is optional. All lab data is synthetic and supplied in the course, and every test runs on your own machine or on systems you are authorized to test.
Format
Time: about 10 to 12 hours, self-paced. Level: intermediate to advanced. Hands-on: five labs, from a threat model written as code to a canary test that proves a confused-deputy control, with an AI tutor that coaches each step from the output you paste.
Structure: a Start here section, four content sections of readings, worked examples, templates and labs, each ending in an AI assessment, and a capstone in which you threat model an agent your organization runs or plans, followed by a reading list.
Grading: the four section AI assessments count for 60 percent of the grade and the capstone assessment for 40 percent. The pass mark is 70 percent.
Currency
Last verified 2026-11-03 against the OWASP Top 10 for LLM Applications 2025, OWASP Agentic AI: Threats and Mitigations (version 1.1, December 2025), the OWASP Top 10 for Agentic Applications for 2026, the OWASP Threat Modeling Cheat Sheet, the MCP Security Best Practices (specification 2025-11-25), NIST AI 100-1, NIST AI 600-1, NIST AI 100-2e2025, MITRE ATLAS release 2026.10, OWASP pytm 1.4.1 and the ibl.ai documentation.
This field changes quickly. OWASP, NIST and MITRE revise their guidance often, tools change between releases, and new attack techniques appear. Check the current versions before relying on any page or template, and test only systems you own or are authorized to test. This course is training, not a security assessment of your systems.
Outline
Section 0 · Start here
- 0.1 Welcome and orientation
Section 1 · Map what an LLM application adds to the attack surface
- 1.1 Why AI changes threat modeling
- 1.2 Data flows and trust boundaries
- 1.3 Section 1 assessment
Section 2 · Find the threats with catalogues and STRIDE
- 2.1 The threat catalogues
- 2.2 STRIDE for AI components
- 2.3 Section 2 assessment
Section 3 · Design out the confused deputy
- 3.1 The confused deputy
- 3.2 The inbox-to-CRM agent
- 3.3 Section 3 assessment
Section 4 · Assign controls, verify them and keep the model current
- 4.1 From threat to control to test
- 4.2 Monitor and review
- 4.3 Section 4 assessment
Section 5 · Capstone and wrap-up
- 5.1 Capstone: a threat model for your organization's agent
- 5.2 Capstone assessment
- 5.3 Reading list and next steps