The use of generative AI technologies in architectural threat modeling automation seems to be a promising alternative to ‘traditional’ formal approaches (e.g., attack-defense trees, domain-specific languages, knowledge graphs, etc.). The main advantage of Large Language Models (LLMs) is that they can work with system and threat descriptions in textual form, skipping the formalization stage required for traditional frameworks.

The work considers how by leveraging local LLMs (i.e., running on enterprise hardware) to overcome the data privacy and regulatory compliance risks associated with feeding proprietary data into online AI systems. Threat modeling was performed via the free Gemma 4 model family on a dataset containing 200 descriptions of containerized applications, and results were compared with those from a formal ontology-driven framework.

The case study demonstrates that local LLMs can serve as replacements for formal systems when matching and reproducing text-based threat modeling rules. The models with 26 and 31 billion (B) parameters can provide adequate metrics (up to 0.975 precision and 0.981 recall for advanced threat models by the 31B LLM with thinking enabled). However, generative AI cannot guarantee metrics as repeatable as those produced by 'strict' automated cybersecurity analysis systems, and it also requires extra computational power for local use to provide rapid threat modeling.