AI Threat Modelling | TryHackMe Answers
Assess and mitigate enterprise AI/ML risks via systematic, defender-focused auditing.
Learning Objectives
- Identify AI-specific assets and attack surfaces that don’t exist in traditional applications
- Apply STRIDE threat categories to AI/ML system components with appropriate context
- Use MITRE ATLAS to enumerate adversarial techniques targeting AI systems
- Map OWASP LLM Top 10 risks to architectural components to identify where threats live and how to prioritise them
- Produce a structured threat assessment for an AI deployment
Prerequisites
- A basic understanding of Threat Modelling concepts (familiarity with STRIDE is helpful, but we’ll do a refresher)
- Knowledge of Web Application Security and Security Principles
- A foundational understanding of AI/ML Security Threats concepts
This room is defender-focused, you’ll learn to evaluate and document AI threats, not exploit them.
The Scenario
You’ve recently joined MegaCorp’s security team as a threat analyst. The company has aggressively adopted AI across multiple business functions:
- A customer-facing chatbot powered by a large language model, connected to internal knowledge bases through a retrieval-augmented generation (RAG) pipeline
- An internal recommendation engine processing sensitive customer data to personalize product offerings
- An automated fraud detection system making real-time authorization decisions on financial transactions
Your CISO has tasked you with conducting a threat assessment of these AI deployments. Executive leadership is concerned about recent headlines, including AI systems being manipulated, training data being extracted, and models behaving unpredictably, and they want to understand MegaCorp’s risk exposure before the quarterly board meeting.
You have one week to deliver a comprehensive threat model. Let’s get to work.
Answer the questions below
- In a RAG-based system, which AI asset type is used to retrieve relevant context at query time?
Embedding Vectors
- An attacker gains access to MegaCorp’s model registry and swaps the production model for a modified version. Which AI-specific asset has been compromised?
Model Registry / Artifacts
- An attacker injects crafted data points into a training pipeline over several months, gradually shifting the model’s decision boundaries. At which supply chain stage does the attacker inject the malicious data?
Data Collection
- Which STRIDE category is insufficient for capturing the delayed, diffuse effects of training data poisoning?
Tampering
- What is the primary AI-specific manifestation of Information Disclosure in the STRIDE-AI mapping?
Model Extraction
- An attacker crafts prompts that cause an LLM to bypass its safety guidelines and content restrictions. Which STRIDE category does this map to?
Elevation of Privilege
- Which OWASP LLM Top 10 (2025) entry addresses the risks of AI systems being granted too many permissions or too much autonomy?
LLM06: 2025 — Excessive Agency
- An attacker drives your monthly inference bill from $15,000 to $180,000 without taking your service offline. What is this type of attack commonly called?
Denial of Wallet
- What does the acronym ATLAS stand for?
Adversarial Threat Landscape for Artificial-Intelligence Systems
- Which ATLAS case study described a self-replicating prompt injection worm that spread between AI agents via RAG email systems?
Morris II
- What is the ATLAS technique ID for Model Extraction?
AML.T0024
- How many of the OWASP LLM Top 10 entries affect the LLM Inference Endpoint?
6
- An organisation notices their chatbot is rendering LLM output directly in the browser without sanitisation. Which OWASP entry does this fall under?
Improper Output Handling
- Which component in a typical LLM architecture is the primary one that needs hardening against data and model supply chain risks (LLM03)?
Training Pipeline
Get Ryca’s stories in your inbox
Join Medium for free to get updates from this writer.
Click the green View Site button to open the AI Threat Modelling exercise: you’ll be selecting OWASP LLM Top 10 vulnerabilities, mapping them to architecture components, and justifying your choices to put your threat modelling instincts to the test. This task can be used to practice your knowledge of AI systems and threats. Good luck!
- What’s the flag?
THM{AI_THREAT_MODEL_COMPLETE}
Conclusion
- Over the course of this room, you worked through a complete AI threat modeling workflow:
- Identified AI-specific assets training data, model weights, embeddings, system prompts, feature stores, and model registries, that expand the attack surface beyond traditional applications
- Mapped the AI data supply chain understanding how data flows from collection through training to inference, and where each stage is vulnerable to compromise
- Adapted STRIDE for AI systems, applying the six familiar threat categories with AI-specific context, from data poisoning under Tampering to jailbreaking under Elevation of Privilege
- Enriched findings with MITRE ATLAS using the AI-specific technique catalogue to move from general threat categories to documented attack methods with technique IDs and mitigations
- Mapped risks to components using the OWASP LLM Top 10 the primary assessment lens that lets you look at an architecture diagram and immediately identify which components carry which risks and at what severity
- Applied everything to MegaCorp assessing real components, mapping OWASP risks with STRIDE and ATLAS enrichment, and generating a prioritised threat assessment
The Workflow at a Glance
This workflow is repeatable. Every time your organisation deploys a new AI system, updates a model, or introduces agentic capabilities, you can run the same process. The frameworks evolve, ATLAS adds new techniques, OWASP updates its list, but the methodology stays consistent.
Key Takeaways
AI systems aren’t just traditional applications with a model bolted on. They have different assets, a separate data supply chain, and failure modes that require adapted approaches.
STRIDE gives you the threat categories, ATLAS gives you the techniques. Together, they provide the vocabulary; STRIDE tells you what type of threat you’re looking at; ATLAS tells you exactly how an attacker would execute it and what mitigations to apply.
OWASP tells you where to point the camera. The LLM Top 10 is the framework that maps risks directly to architectural components. It’s what lets you look at a deployment and say “this component carries these risks at this severity”, and that’s the skill that makes a threat assessment actionable.
What Comes Next
This room covered the assessment methodology and how to identify and document AI threats. To go further:
- MITRE ATLAS(opens in new tab): Explore the full technique catalogue, case studies, and mitigations beyond what we covered here
- OWASP AI Exchange(opens in new tab): Explore broader AI security guidance including agentic AI and non-LLM systems
