FlagThis

Abstract

Threat modeling is essential for secure software development, yet manual analysis of cloud-native Threat modeling architectures is slow and demands scarce security expertise. We present THREATFOREST, a multiAttack trees agent system that generates structured attack trees from source code repositories, maps attack MITRE ATT&CK steps to adversary tactics, techniques, and procedures (TTPs) from a pluggable set of frameworks Multi-agent systems (MITRE ATT&CK, CAPEC, and cloud-specific threat matrices), and synthesizes actionable Large language models mitigations. THREATFOREST decomposes threat modeling into a multi-stage agent pipeline Cloud security repository analysis, context refinement, threat generation, parallel attack-tree construction with TTP mapping and mitigation synthesis, and report generationorchestrated as a directed graph with deterministic verification gates, bounded retries, and three human-in-the-loop validation points. A domain-specific sentence-transformer maps each attack step to candidate techniques by cosine similarity; we show empirically that this embedding stage, not the surrounding pipeline, is the dominant accuracy bottleneck. We evaluate THREATFOREST across seven application domains on a sixteen-dimension rubric, scored by a panel of independent LLM raters with an adversarial verification pass and human-in-the-loop expert review. Panel-measured quality reaches 0.630.68 (on a 01 scale) for threat statements, attack trees, and mitigations, but only 0.29 for embedding-only TTP mappinga gap stable across all seven domains that isolates the binding constraint. A controlled single-call baseline on the same model more than doubles mapping defensibility, pinning the limitation on the embedding encoder rather than the multi-agent design. To our knowledge, THREATFOREST is the first end-to-end system that turns a code repository into TTP-mapped attack trees with evidence-based mitigations across multiple adversary frameworks, with a reusable evaluation framework for benchmarking such systems.