MAESTRO Threat Modeling: A Framework for Securing Agentic AI

As AI agents become a bigger part of how software gets built, their reach is growing too. Every connection to a code repository, internal service, or dataset gives an agent more power to get work done. It also creates another opportunity for something to go wrong.

The pressure to keep expanding that access is understandable. In Stack Overflow’s 2025 Developer Survey, 69% of developers who use AI agents said they had become more productive. But the same permissions that make an agent useful can also allow it to expose sensitive data or make changes it was never meant to make.

For security teams, that raises a practical question: if an agent is compromised or misled, what else could it reach? MAESTRO helps teams work through that question by examining threats across an agentic system and how its connections could become attack paths.

What is MAESTRO threat modeling?

MAESTRO (Multi-Agent Environment, Security, Threat, Risk, and Outcome) is a threat modeling framework built specifically for agentic AI: systems in which autonomous agents use tools, interact with other agents, and act on their environment.

It was introduced in February 2025 by Ken Huang, co-chair of the Cloud Security Alliance (CSA) AI Safety Working Groups, in a post on the CSA blog.

The framework breaks an agentic system into seven layers, identifies the threats specific to each one, and then looks at how an attack in one layer can spread to the others. It is aimed at security engineers, AI researchers, and developers who need to identify, assess, and mitigate risk across the full AI lifecycle.

Why traditional methodologies fall short for agentic AI

STRIDE, PASTA, LINDDUN, OCTAVE, Trike, and VAST are still useful for AI systems, but none of them were designed with autonomous agents in mind. MAESTRO builds on those methodologies with the aim of addressing gaps that appear when securing agentic systems:

• Autonomy: agents make their own decisions, so their actions are harder to predict, and their goals can drift away from what was intended. A trading agent whose objective has been tampered with could end up working to maximize losses instead of gains.
• Machine learning attacks: classic threat categories have no specific place for data poisoning, evasion attacks built on adversarial inputs, or model extraction through repeated API queries.
• Agent-to-agent interaction: when several agents work together, they can collude, compete in ways that cause harm, or be impersonated by fake agents.
• System-level issues: limited explainability makes incidents hard to trace and audit, and agents depend on pre-trained models, ML libraries, and datasets whose provenance is often unclear.

The seven layers of MAESTRO

MAESTRO is built on a seven-layer reference architecture for agentic AI, also developed by Ken Huang. Each layer has its own function and its own threat landscape, which lets teams reason about risk at a granular level instead of treating “the AI” as a single black box.

Cross-layer threats

Some of the most serious risks only show up when you look at how the layers connect.

For example, an attacker could exploit a weakness in the container infrastructure (layer 4) to reach a running agent, use that access to plant malicious data in the agent’s data store (layer 2), and poison the next model update, compromising the foundation model itself (layer 1).

MAESTRO calls out several cross-layer threat types:

• Supply chain attacks: a compromised component in one layer, such as a library in the agent framework, affects everything built on top of it.
• Lateral movement: access gained in one layer is used to compromise another.
• Privilege escalation: an agent or attacker gains unauthorized privileges in one layer and uses them elsewhere.
• Data leakage: sensitive data from one layer is exposed through another.
• Goal misalignment cascades: a misaligned agent, for instance one affected by poisoned data, spreads that misalignment to other agents it interacts with.

Mitigation strategies in MAESTRO

MAESTRO groups mitigations into three families:

• Layer-specific mitigations: controls tailored to the threats identified in each individual layer.
• Cross-layer mitigations: defense in depth, secure communication between layers, system-wide monitoring for anomalous behavior, and an incident response plan that covers incidents spanning several layers.
• AI-specific mitigations: adversarial training, formal verification of agent behavior and goal alignment, explainable AI to support audits, red teaming, and runtime safety monitoring.

Common agentic architecture patterns and their risks

The framework also looks at typical ways agentic systems are built and the threat that matters most for each one.

How to apply MAESTRO in ThreatModeler Nexus

Applying MAESTRO by hand means mapping each agent to the layers it touches, then building the threats and fixes for every one of those layers from scratch.

In ThreatModeler Nexus, that second part is built in for components in the AI-ML library, which carry a MAESTRO layers attribute.

Add a component to the same threat model as the rest of your application, select the layers it works in, and the matching threats and security requirements are added for you to review.

Decompose your system

Add agents, large language models, AI gateways, agent-to-agent connections, and managed AI services such as Azure, OpenAI, and Google’s Gemini Enterprise Agent Platform, to the same diagram as the rest of the system.

For each one, the team selects the MAESTRO layers it operates in. Most components span more than one, and every layer is described in the product.

Model layer-specific threats

The team starts from a threat set for each layer instead of building one for every agent. Selecting a layer adds threats such as data poisoning and model inversion to the component, and the AI-ML library includes threats drawn from MITRE ATLAS that teams can search for by name.

Identify cross-layer threats

A cross-layer option covers threats that span layers. Because AI components sit in the same model as the infrastructure around them, the connections an attacker could chain together are on one diagram.

Assess risk

AI threats carry risk ratings like every other threat in the model, so agentic components can be prioritized alongside the rest of the application.

Plan mitigations

Each threat comes with security requirements, such as data validation, access control, and adversarial training. The team can send them to Jira, Azure Boards, ServiceNow, or Mantis for engineering to act on.

Implement and monitor

When an agent gains a new tool or data source, adding it to the diagram and setting its layers brings its threats and requirements with it.

The benefits of MAESTRO threat modeling in ThreatModeler Nexus

MAESTRO gives security teams a structured way to reason about agentic AI, one layer at a time. ThreatModeler Nexus brings that structure into the threat model they already maintain: agents, models, and AI services sit alongside the applications and infrastructure they depend on, and each layer adds its threats and security requirements without manual mapping.

Teams secure agentic AI with the same practice they use for the rest of their software. As agents gain new tools and connections, the team adds them to the diagram, and the answer to what else an agent could reach stays current.

Ready to get started?

Sources

• Stack Overflow, 2025 Developer Survey press release
• Ken Huang, Cloud Security Alliance, Agentic AI Threat Modeling Framework: MAESTRO (2025)
• Ken Huang, 7-Layered Agentic AI Reference Architecture
• MITRE ATLAS, Techniques
• MITRE ATLAS, Mitigations