2026-10-06T22:27:56Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:28025 2026-10-05T06:44:05Z ddc:004 open_access

Emerging Challenges in Threat Modeling for GenAI-Augmented Systems: A View from the Trenches Díaz Ferreyra, Nicolás E. Kumar, Manish Mahesh Villarreal, Nohemí Pantel, Pankaj Brueggemann, Immo Scandariato, Riccardo Threat Modeling Software Architectures Generative AI ML Sec4AI Threat modeling remains a central task in secure software engineering, as it enables the identification of security issues from system architectures. As Generative Artificial Intelligence (GenAI) becomes increasingly pervasive across software systems, traditional threat modeling methods (e.g., STRIDE) are insufficient to assess emerging GenAI-specific risks. In this work, we present the first results from an exploratory assessment of GenAI-aware threat modeling methods in a Small and Medium Enterprise (SME) setting. For this, we conducted a rapid literature review to select relevant techniques and systematically applied three shortlisted methods to an industrial case study involving a GenAI-augmented system. The results highlight differences in the threats identified by each technique and reveal limited support for certain GenAI-specific risk categories, particularly those related to software supply chains and human-centered security issues. We further report practitioners' perceptions of the usability and integration of these methods in SME development workflows, including their perceived effort and adoption challenges. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Nicolás E. Díaz Ferreyra and Manish Mahesh Kumar and Nohemí Villarreal and Pankaj Pantel and Immo Brueggemann and Riccardo Scandariato 2026 Is Part Of LIPIcs, Volume 394, 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/LIPIcs.ESEM.2026.57 urn:nbn:de:0030-drops-280253 https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ESEM.2026.57 eng https://creativecommons.org/licenses/by/4.0/legalcode