Adam Shostack

Your threat model should name the model, its version, the data it touches, the tools it can call, and the permissions it holds.

Adam Shostack's updated threat modeling book, which covers AI, lands February second, twenty twenty-seven.

Score the threats by harm, not by a generic severity label, and tie each rating to the essential performance you defined.

NIST's AI Risk Management Framework can structure the governance, and WASP's AI Vulnerability Scoring System can help rank agentic vulnerability.