Agentic Security Hub

Tools

Threat Modeler

Free browser-based threat modeling tool for agentic AI: draw your system and get OWASP agentic threats, MAESTRO layers, attack paths, AISVS coverage and fixes.

  • 49 analysis rules
  • 10 templates
  • 13 component types

Read the guide

The Threat Modeler runs entirely in your browser and needs JavaScript. Draw the agents, models, memory, tools and data flows of your system, then run the analysis to get OWASP agentic threats, MAESTRO layers, attack paths, OWASP AISVS coverage and mitigations. Models are saved in this browser and can be exported as JSON, Markdown, PDF or SARIF.

Start from a template

  • RAG Pipeline

    Retrieval-Augmented Generation pipeline with user, LLM, vector store, and external data source.

  • Hierarchical Multi-Agent

    Orchestrator delegating to a research agent (web search) and a coding agent (code execution).

  • Simple Agent

    A single agent with memory and an LLM.

  • Sequential Pipeline

    Input validation, processing agent and an output guard in a fixed sequence.

  • Collaborative Swarm

    Peer agents collaborating over mTLS and sharing a knowledge base.

  • Reactive Agent

    Event-driven agent that decides with an LLM, acts through a tool and logs events.

  • Knowledge-Intensive Agent

    Agent combining vector search, a knowledge graph and external APIs.

  • MCP-connected Coding Agent

    IDE coding agent using a local filesystem MCP server, a remote GitHub MCP server behind an approval prompt, a community MCP server and a code sandbox.

  • Customer-Support Agent (RAG + HITL)

    Support agent behind an input/output guardrail, answering from a knowledge base, with per-user memory, an audit log and human approval for refunds.

  • Multi-Agent Research Swarm (A2A)

    Coordinator delegating over A2A to internal research and analysis agents and to a partner organisation's agent, with shared memory and tracing.

Component types

  • Agent: Plans and acts on untrusted input; the main target of goal hijacking.
  • Orchestrator: Delegates to other agents; a compromise cascades to every worker.
  • LLM: Follows instructions found anywhere in its context window.
  • Episodic Memory: Persists what the agent saw; poisoned entries steer future sessions.
  • Semantic Memory: Long-lived facts the agent trusts; a write path for persistent injection.
  • Vector Store: Retrieved chunks enter the prompt verbatim (RAG poisoning).
  • Tool (scoped): Every tool call is an action; scopes and allow-lists bound the blast radius.
  • MCP Server: Tool descriptions and results flow straight into the model (tool poisoning).
  • A2A Peer: Another organisation's agent: its messages are untrusted instructions.
  • Guardrail / Policy: Inspects traffic it sits on; lowers likelihood of threats behind it.
  • Human Approval Gate: Breaks attack paths to privileged actions — if approvals stay meaningful.
  • Identity Provider / Credential: Issues the tokens agents act with; delegation without narrowing is privilege abuse.
  • Observability: Without traces you cannot detect a rogue or hijacked agent.