MAESTRO: Threat Modeling for Agentic AI

MAESTRO stands for “Multi-Agent Environment, Security, Threat, Risk, and Outcome”. The framework was published on February 6, 2025 by Ken Huang (CEO & Chief AI Officer of DistributedApps.ai) on the Cloud Security Alliance blog and is explicitly designed for agentic AI – that is, for systems in which AI agents make decisions autonomously, use tools and interact with one another. At its core is a seven-layer reference architecture along which threats are identified layer by layer. MAESTRO does not replace established methods; it deliberately extends them with agentic and ML-specific perspectives.

Established methods model software with predictable behavior. According to the CSA's rationale, STRIDE lacks a view of AI-specific threats such as adversarial attacks and the unpredictable learning and decision-making behavior of agents; PASTA addresses neither attacks on models (such as model extraction) nor the complexity of autonomous decisions; the privacy-focused LINDDUN does not cover key security threats to agentic systems such as data poisoning. On top of that come aspects that none of the classic methods captures systematically: unpredictable agent behavior, goal misalignment, collusion between agents and risks from the AI supply chain. These are exactly the gaps MAESTRO is built to close.

MAESTRO decomposes an agentic AI system into seven layers: Foundation Models (layer 1, the base models), Data Operations (layer 2, including data storage and RAG pipelines), Agent Frameworks (layer 3, development frameworks and orchestration), Deployment and Infrastructure (layer 4), Evaluation and Observability (layer 5, monitoring and assessment), and Agent Ecosystem (layer 7, the interplay of many agents in marketplaces and business applications). Security and Compliance (layer 6) plays a special role: it is defined as a vertical cross-cutting layer that runs through all the others. Each layer brings its own threat classes, responsibilities and controls.

The process described by the CSA comprises six steps: system decomposition along the seven layers, layer-specific threat modeling, identification of cross-layer threats, risk assessment, mitigation planning, and implementation with continuous monitoring. The cross-layer threats are particularly relevant: a compromised library in the agent framework affects the other levels, access rights can escalate between layers, and goal misalignment effects of individual agents cascade through the entire ecosystem. Threat modeling with MAESTRO is therefore not a one-off document but a recurring process that is run again whenever the architecture changes.

With “Agentic AI – Threats and Mitigations” (v1.0 from February 2025, currently version 1.1 from December 2025), the OWASP Agentic Security Initiative maintains a catalog of 17 agentic threats (T1–T17) – from Memory Poisoning (T1) and Tool Misuse (T2) through Rogue Agents in Multi-Agent Systems (T13) to Insecure Inter-Agent Protocol Abuse (T16, including protocols such as MCP and A2A) and Supply Chain Compromise (T17). The OWASP document itself references MAESTRO as a layer-based extension of STRIDE for agentic AI. In practice the two complement each other: MAESTRO provides the structure (where in the system to look), the OWASP catalog provides the content (what to look for in each layer).

A typical run starts with scope definition (which agents, tools, data flows and interfaces belong to the system) and an architecture walkthrough in which all components are mapped to the seven layers. Threats are then identified per layer – with the OWASP catalog serving as a checklist – and complemented by cross-layer scenarios. The assessed risks feed into a prioritized mitigation plan and into existing processes such as the secure development lifecycle and the ISMS. The CSA itself has shown that the method also works for agent protocols: in April 2025, Google's Agent-to-Agent protocol (A2A) was fully modeled with MAESTRO.