<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-threat-modeling-automation
description: >-
  Automate threat modeling in CI/CD pipelines using pytm, Threagile, and custom tooling to generate threat models from code, detect architectural drift, and enforce security gates on pull requests.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - automation
  - ci-cd
  - pytm
  - threagile
  - pipeline
  - devsecops
  - security-gates
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195", "T1059", "T1190"]
---

# Implementing Threat Modeling Automation

## Overview

Automated threat modeling integrates threat analysis directly into CI/CD pipelines, enabling
continuous security assessment as architectures evolve. This technique covers pytm and
Threagile integration, architectural drift detection, and PR-based security gates.

Mode: `[MODE: ARCHITECT]` — CI/CD-integrated automated threat analysis.

## Prerequisites

- `pytm` for code-based threat models: `pip install pytm`
- `threagile` for YAML-based threat models: `go install github.com/Threagile/threagile@latest`
- CI/CD platform (GitHub Actions, GitLab CI, Jenkins)
- Python 3.10+, Graphviz

## Key Concepts

### Automation Approaches

| Tool | Input | Output | Best For |
|------|-------|--------|----------|
| pytm | Python code | DFD, threats, reports | Developer-defined models |
| Threagile | YAML model | Risk report, DFD | Architecture-as-code |
| Custom scripts | JSON/YAML | Threat catalog | Organization-specific |

### Pipeline Integration Points

1. **Pre-commit**: Validate threat model syntax
2. **PR check**: Generate diff of threat model changes
3. **Build stage**: Full threat enumeration and scoring
4. **Release gate**: Block on unmitigated CRITICAL threats
5. **Scheduled**: Weekly full re-analysis with updated threat intel

## Workflow

### Step 1: Define Threat Model as Code

```bash
# Initialize a pytm-based threat model
node scripts/agent.js --action init --framework pytm --output tm.py
```

### Step 2: Configure CI Pipeline

```bash
# Generate GitHub Actions workflow
node scripts/agent.js --action pipeline --ci github-actions --output .github/workflows/threat-model.yml
```

### Step 3: Run Automated Analysis

```bash
# Execute automated threat analysis
node scripts/agent.js --action analyze --model tm.py --output threats.json

# Check for architectural drift
node scripts/agent.js --action drift --baseline baseline.json --current threats.json
```

### Step 4: Enforce Security Gates

```bash
# Validate no unmitigated critical threats
node scripts/agent.js --action gate --threats threats.json --max-critical 0 --max-high 3
```

## Verification

- [ ] Threat model defined as code in version control
- [ ] CI pipeline generates and validates threat model on every PR
- [ ] Architectural drift detection compares against baseline
- [ ] Security gate blocks deployment on unmitigated critical threats
- [ ] Threat model artifacts stored as build outputs
- [ ] Weekly scheduled re-analysis with updated threat intelligence

## References

- [pytm Documentation](https://github.com/OWASP/pytm)
- [Threagile](https://threagile.io/)
- [OWASP Threat Modeling Automation](https://owasp.org/www-project-threat-model/)
- [Threat Modeling in CI/CD](https://www.threatmodelingmanifesto.org/)
