Abuse Case

Threat modeling where the LLM can't invent a CVE, and code computes the risk score By Daniel Nweke Project page: https://towardsdatascience.com/abuse-case/ ShipAI is a Towards Data Science project. Watch all the videos here: https://towardsdatascience.com/videos/ Key takeaways. 1. Describe an architecture and GPT-4o builds the system model, data flow diagram, STRIDE threats and business logic abuse scenarios. 2. A second critic pass audits STRIDE category balance, and CWE or ATT&CK IDs missing from offline JSON catalogs are dropped. 3. CVEs come only from the National Vulnerability Database, and the risk score is calculated in TypeScript, not by the LLM. Chapters: 0:00 Why threat modeling stalls 1:01 Beyond STRIDE 3:00 Architecture to data flow diagram 5:54 STRIDE threats 7:33 Business logic abuse 8:53 Live CVEs from NVD 10:03 The risk register 11:15 How it's built