Original title: A Threat Modeling Prioritization and Automation Framework for Composable Architectures
Liviu-Mihai Popescu, Remus Brad · September 2026
Modern software systems are built from modular pieces—like services, apps, and autonomous agents—that constantly connect and change. These are called composable architecturesSoftware systems built from independent parts that can be assembled and rearranged like building blocks.. Meanwhile, attackers use fast automation, and security teams lack the time and people to protect everything. Normally, teams only check for security flaws, a step called threat modeling, once in a while. The researchers designed a new framework to turn threat modeling into a continuous, evidence-based process that guides where to spend scarce security resources. It works by setting clear, measurable boundaries around individual services and using Zero TrustA security model that never automatically trusts any user or system, always verifying before granting access. rules, which assume no network part is automatically safe. The researchers found that fully relying on artificial intelligence to automate defense is risky because AI brings fast-changing risks that are hard to measure. Instead, automation must have clear limits, and AI should assist human experts rather than replace them, helping them spot hidden links and make smarter defense choices.
Imagine a factory where machines are constantly swapped and reconfigured. A fixed safety inspection schedule misses new hazards because the layout changes daily. In this paper, the security planning for dynamic software systems faces the same challenge: traditional one-time checks are too slow. The framework automates the inspection but sets clear boundaries and keeps a human expert in the loop for critical decisions.
Organizations with complex, ever-changing software systems struggle to keep up with cyber threats. This framework helps them focus limited security resources on the highest risks, turning threat modeling from a one-time check into an ongoing process. It also ensures that automation and AI assist human experts rather than replace them, leading to more resilient systems.
The framework is conceptual and based on a literature review, not on empirical testing. It does not provide specific metrics or implementation details. The effectiveness of the proposed automation boundaries and human-in-the-loop governance has not been validated in real-world composable environments. Additionally, the fast-changing nature of AI risks may outpace the framework's ability to adapt.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
A Threat Modeling Prioritization and Automation Framework for Composable Architectures — Liviu-Mihai Popescu, Remus Brad — Future Internet — doi:10.3390/fi18100499
Abstract licence: CC BY
Explanation generated by Synthesis from the abstract — it is not the original paper.