AWS Security Agent announces support for Threat Modeling
AI-powered STRIDE threat models generated automatically from your code or design docs — free during preview, right inside your IDE.
View original announcement →Visual Summary
graph TD
A{{AWS Security Agent Threat Modeling}}:::announced
B((Developer)):::external
C([Design Documents]):::feature
D([Source Code]):::feature
E([STRIDE Analysis]):::feature
F([Actionable Mitigations]):::feature
G(Kiro IDE):::compute
H(Claude Code CLI):::compute
I(AWS Continuum):::compute
B ==>|"provides inputs"| A
C -->|"architecture context"| A
D -->|"code context"| A
A -->|"classifies threats"| E
A -->|"generates"| F
G ==>|"integrates"| A
H -->|"integrates"| A
A -.->|"part of"| I
classDef announced fill:#ff9900,stroke:#ec7211,color:#fff,font-weight:bold
classDef compute fill:#e3f2fd,stroke:#1565c0,color:#1565c0
classDef storage fill:#e8f5e9,stroke:#2e7d32,color:#2e7d32
classDef feature fill:#fff3e0,stroke:#e65100,color:#e65100
classDef external fill:#f5f5f5,stroke:#616161,color:#616161
What's New
AWS Security Agent, now part of AWS Continuum, has launched threat modeling in public preview — an AI-powered agentic capability that automatically generates structured threat models for applications. The feature analyzes design documents and/or source code to identify threats across all six STRIDE categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) with severity ratings and actionable mitigations. It integrates directly into developer IDEs such as Kiro and Claude Code, as well as any MCP-compatible AI-powered IDE, enabling security to be embedded early in the design phase.
How It Works
- Input ingestion: Developers or security teams provide technical design documents (scope docs), application source code, or both as inputs to the agent, giving it full architectural context.
- Deep contextual analysis: The agent uses agentic AI reasoning to parse architecture, identify components, map data flows, and establish trust boundaries — going beyond simple pattern matching.
- STRIDE classification: Identified threats are categorized across all six STRIDE dimensions with associated severity levels, producing a structured and prioritized threat model.
- Actionable mitigations: Each threat is paired with specific, contextually relevant remediation recommendations rather than generic guidance.
- System overview generation: The agent produces a system overview describing the application's architecture, components, trust boundaries, data flows, and overall security posture.
- IDE and CLI integration: Threat models can be generated directly from Kiro IDE, Claude Code CLI plugin, or any MCP-compatible AI IDE, surfacing results inline without context switching.
- Reusable configurations: Generated threat models are saved as reusable configurations that can be updated as the application evolves.
Why It's Important
- Democratizes specialized expertise: Traditional threat modeling requires seasoned security architects; this capability makes rigorous STRIDE-based analysis accessible to any development team without dedicated security headcount.
- Shifts security left: By integrating into IDEs and design-phase workflows, threats are identified and mitigated before code is written or deployed, dramatically reducing the cost of remediation.
- Reduces manual effort: What previously required hours or days of expert manual work is automated, allowing security teams to scale reviews across many development teams simultaneously.
- Consistent enforcement: Security teams can define organizational requirements once and have the agent apply them uniformly across all threat models, eliminating inconsistency across teams.
- Accelerates pre-deployment assessments: Security teams can run threat models against design documents and source code as a gate before deployment, without creating pipeline bottlenecks.
- Closes the shift-left gap: Most shift-left tools focus on code vulnerabilities; threat modeling addresses architectural and design-level risks that static analysis tools typically miss.
How It's Different
- Agentic reasoning vs. rule-based scanning: Unlike traditional SAST or SCA tools that match patterns, AWS Security Agent uses deep AI reasoning to understand application context, architecture, and intent before identifying threats.
- Dual input support: The agent accepts design documents, source code, or both — most threat modeling tools require one specific input format, limiting flexibility.
- Native IDE integration via MCP: Results surface inline in Kiro, Claude Code, and any MCP-compatible IDE, eliminating the context-switching overhead common with standalone security tools.
- Full STRIDE coverage with severity: The agent covers all six STRIDE categories with severity levels and mitigations in a single pass, whereas manual processes often cover only a subset or lack prioritization.
- Part of a unified security lifecycle platform: Threat modeling is integrated alongside code review, penetration testing, and design review within AWS Continuum, providing end-to-end coverage rather than a point solution.
- No additional cost during preview: Unlike many enterprise threat modeling tools that carry significant licensing costs, this capability is available at no extra charge during public preview.
When to Prefer It
- Early design phase: Use it when architects and developers are writing technical specs or scope documents, before any code is committed, to catch architectural flaws at the lowest remediation cost.
- Pre-deployment security gates: Use it as a mandatory pre-deployment check for security teams who need to validate that new features or services have been threat-modeled against current source code.
- Teams without dedicated security architects: Ideal for development teams that lack embedded security expertise but need to produce defensible, structured threat models for compliance or governance purposes.
- Rapid iteration environments: Use it in agile or continuous delivery environments where frequent design changes make manual threat modeling impractical to keep current.
- Pull request and code review workflows: Use it alongside the PR scanning feature to ensure that significant code changes trigger an updated threat model, keeping security posture aligned with the codebase.
- Multi-team organizations: Use it when a central security team needs to enforce consistent threat modeling standards across many development teams without reviewing each one manually.
- Compliance and audit preparation: Use it to generate documented, STRIDE-categorized threat models required for security certifications, audits, or regulatory frameworks.
Availability
- Status: Public preview as of June 17, 2026; not yet generally available.
- Regional availability: Available in all AWS regions currently supported by AWS Security Agent (specific region list not enumerated in the announcement; check the AWS Security Agent documentation for the current supported region list).
- Pricing: No additional cost during the public preview period; standard AWS Security Agent pricing applies to other capabilities.
- IDE integrations: Supported in Kiro IDE, Claude Code CLI plugin, and any MCP-compatible AI-powered IDE or tool.
- Source control integrations: Code review (which complements threat modeling) supports GitHub, GitLab, Bitbucket (SaaS and self-hosted), and Confluence for documentation context.
- Limitations: As a preview feature, it may be subject to service limits, feature changes, and is not recommended for production-critical compliance workflows without validation.
