Which threat modeling method works well with iterative development common in AI solutions but lacks AI-specific threats?

Which threat modeling method works well with iterative development common in AI solutions but lacks AI-specific threats?

• A. STRIDE
• B. VAST
• C. Trike
• D. PASTA

Answer: (C)

This question is about choosing a threat modeling approach that works smoothly with iterative AI development and isn’t tied to AI-specific threat lists. Trike fits this well because it uses threat trees and focuses on security requirements rather than predefined attack catalogs. That makes it highly adaptable to changing AI architectures, data pipelines, and deployment contexts as models are retrained or features are added—the threats can be expanded or refined as the system evolves without being constrained by a fixed taxonomy. Since Trike centers on what needs to be protected and the security requirements needed to achieve that protection, it naturally supports incremental refinement. You can progressively add threats and corresponding mitigations as new AI-specific concerns emerge, rather than trying to cover everything upfront with AI-specific categories. Other methods offer valuable perspectives in their own right, but they tend to be more prescriptive or heavy for rapid iteration. STRIDE provides a broad threat categories framework, which can be powerful but may feel rigid and less targeted to evolving AI contexts. VAST emphasizes agile visualization and integration into fast development cycles, which helps with iteration but doesn’t inherently structure security goals around evolving AI threats. PASTA is thorough and risk-focused, which is excellent for deep analysis but can slow progress in rapidly changing AI projects.

This question is about choosing a threat modeling approach that works smoothly with iterative AI development and isn’t tied to AI-specific threat lists. Trike fits this well because it uses threat trees and focuses on security requirements rather than predefined attack catalogs. That makes it highly adaptable to changing AI architectures, data pipelines, and deployment contexts as models are retrained or features are added—the threats can be expanded or refined as the system evolves without being constrained by a fixed taxonomy.

Since Trike centers on what needs to be protected and the security requirements needed to achieve that protection, it naturally supports incremental refinement. You can progressively add threats and corresponding mitigations as new AI-specific concerns emerge, rather than trying to cover everything upfront with AI-specific categories.

Other methods offer valuable perspectives in their own right, but they tend to be more prescriptive or heavy for rapid iteration. STRIDE provides a broad threat categories framework, which can be powerful but may feel rigid and less targeted to evolving AI contexts. VAST emphasizes agile visualization and integration into fast development cycles, which helps with iteration but doesn’t inherently structure security goals around evolving AI threats. PASTA is thorough and risk-focused, which is excellent for deep analysis but can slow progress in rapidly changing AI projects.