Background
Many AI threat modeling methods already exist, but two systematic gaps keep showing up. First, most of them were designed purely for LLMs, while the greatest risk today lies in Agentic AI, not in the language model alone: autonomous action, tool access, persistent memory, and self-modification. Second, the one framework that genuinely fits Agentic AI Agents well, MAESTRO, is too complex and demands deep technical expertise to apply.
This is an unnecessary barrier. As AI agents become mainstream, the discipline of threat modeling them needs to be simplified so that people without a specialized security background can model agent risk on their own. AGENTIC was built to close that gap.
Purpose
- Simple: applicable without a lengthy onboarding process.
- Intuitive: questions phrased so they are understandable without prior AI Security knowledge.
- Built for Agentic AI: unlike frameworks designed for LLMs, it addresses the specifics of agent autonomy and action.
- A complement, not a replacement: AGENTIC is meant as an entry point, after which teams can move to deeper, more technical frameworks when needed (see the comparison below).
Target audience
AGENTIC lowers the barrier to modeling threats for Agentic AI – the highest-risk category of AI use – so the method is accessible not only to AI security specialists, but also to:
- Security professionals who need to assess agentic solutions without deep prior expertise in AI security.
- Developers/engineers building an agent who need a fast pre-production sanity check.
- “Security champions” on product teams – technical people who are not security specialists but act as the first line of risk assessment.
- Anyone responsible for deploying AI agents who needs a shared, non-technical language to discuss “what could go wrong” with a technical team.
The seven elements
AGENTIC structures the analysis around seven elements, each anchored by a single guiding question that keeps the discussion intuitive and non-technical.
| Element | What it covers | Guiding question | |
|---|---|---|---|
| A | Autonomy | How much the agent decides and executes without human approval | How much can the agent do before anyone notices? |
| G | Grounding | How the agent ties its outputs to real-world truth and data sources | How does the agent know that what it “knows” is true? |
| E | Environment | The execution environment and the scope of access/permissions it grants | What can the agent run or change? |
| N | Neural Memory / Knowledge | What the agent stores and reuses as knowledge, short- and long-term | What does the agent remember between sessions? |
| T | Tools | External capabilities the agent can invoke (APIs, functions, MCP) | What is the worst thing the agent could do by combining its tools? |
| I | Iterative self-modification | The agent’s ability to change its own behavior over time | How can the agent modify itself? |
| C | Control | Human ability to oversee the agent and intervene when needed | Can anyone shut it down before it’s too late? |
Applying the model
The modeling process follows four steps:
- Work through each of the seven elements in order (A → G → E → N → T → I → C), answering first the main diagnostic question, then the deeper follow-up questions. This order limits the risk of missing dependencies, since each element partly builds on the answers from the previous ones.
- Write every answer down; together they form a model of the entire agentic system.
- For each element, once all questions are answered, identify the single weakest point: a missing mechanism, unclear ownership, which becomes a candidate for high risk.
- While analyzing each subsequent element, actively question it against the risks already surfaced in earlier ones.
What AGENTIC does not cover
AGENTIC is deliberately scoped to agent-level architecture and behavior, so several adjacent problem areas are intentionally left to other frameworks and processes:
- Model- and training-level threats – attacks on the training process, weight extraction, membership inference, adversarial examples at the network-architecture level. This is the domain of frameworks such as MITRE ATLAS in its full scope, not AGENTIC.
- Deep analysis of a single prompt or interaction – AGENTIC operates at the level of agent architecture and configuration, not individual dialogue turns. OWASP LLM Top 10, applied directly at the LLM layer, is better suited for that.
- Regulatory compliance – AGENTIC is not designed as a compliance checklist for the EU AI Act, ISO/IEC 42001, or similar regulations; compliance requirements define their own set of demands on an AI agent.
Elimination of subjectivity – like any qualitative model, AGENTIC’s results depend on the knowledge and experience of the person modeling. AGENTIC does not remove that subjectivity, only structures it.
Comparison with other frameworks
AGENTIC was not built in a vacuum. It is designed to combine well with existing frameworks rather than compete with them.
| Framework | Focus | Relationship to AGENTIC | Limitations |
|---|---|---|---|
| PHANTOM-B | Lightweight framework focused on LLM deployments | A peer entry point: PHANTOM-B for LLM deployments, AGENTIC for systems with real autonomy | Not built for covering full agentic autonomy |
| MAESTRO | Comprehensive 7-layer architecture framework for multi-agent systems | AGENTIC acts as a bridge toward this deeper method for AI security specialists | Requires mapping the full layered architecture and strong technical background; high entry barrier |
| STRIDE-AI | LLM-focused method analyzing 5 system layers and 6 threats categories | Can sharpen the focus on specific threat classes once combined with AGENTIC | Authors state it is currently optimized for LLMs, not full agentic autonomy or multi-step real-world action |
| MITRE ATLAS | Continuously updated taxonomy of concrete adversarial techniques | Supplies concrete techniques for each AGENTIC element to deepen the analysis | A threat dictionary, not a modeling method. It doesn’t tell you where to start |
| OWASP LLM Top 10 | Widely known LLM threat classification, shared language with product teams | A natural extension of PHANTOM-B for LLM-specific work | Weak coverage of the agent’s real-world action layer (tools, persistent memory, autonomy) |
| OWASP Agentic Top 10 | Risk catalogue for agentic applications with precisely named categories | Complements AGENTIC by sharpening focus on specific threat classes | A list of risks, not a step-by-step process through a specific architecture |
| SAILORS | Mitigation-focused checklist evaluated per capability | Works well as an implementation checklist alongside AGENTIC | Focused on a single AI capability, not on modeling autonomous behavior over time |
Summary
AGENTIC gives teams a fast, language-accessible way to reason about where an AI agent’s real risk lives and a clear path to deeper frameworks once a system’s risk profile calls for it.