Executive Summary
The market for threat modeling is no longer defined by a simple contrast between manual methods and automated platforms.
It is being reshaped by a second shift: the arrival of generative AI in design-time security. That shift is real, but the Hanover data suggests it is still immature. Organizations are increasing their use of AI-assisted threat modeling, yet confidence in AI outputs remains limited – particularly where systems are regulated, safety-critical, or operationally complex.
A critical gap has been created: AI is being adopted because it promises speed, but it is being constrained because security requires assurance. Threat modeling sits directly inside that gap because it is not just a content-generation task. It is the discipline that turns architecture and system intent into decisions about threats, controls, documentation, ownership, and governance. AI can accelerate parts of that process, but the data in this report suggests that organizations do not yet trust AI to replace it.
