Threat-modeling expert Adam Shostack has developed a framework that can identify meaningful AI security risks in as little as 15 minutes, addressing a growing problem as companies struggle to assess threats from generative AI tools without slowing down deployment. The framework, called PHANTOM-B, was presented at Black Hat USA 2026 and is designed to complement existing security models by focusing specifically on risks tied to large language models. Shostack tested the approach recently when a client asked him to evaluate an AI app that had been quickly built and deployed with customer data, producing a list of threats including hallucination and bias that traditional frameworks would have missed.
PHANTOM-B stands for Prompt injection, Hallucination, Anthropomorphization, Non-explainability, Training issues, Overreliance, Missing security engineering, and Bias. Each letter represents a distinct threat category aimed at LLM components within a broader system. The framework is meant to work alongside STRIDE, a widely used application-security model that covers entire applications but doesn't capture AI-specific vulnerabilities. According to Shostack's white paper, the short-session format makes threat modeling less expensive and more likely to occur, fitting into one-hour meetings or even 10-minute executive conversations. The framework touches on concepts like anthropomorphization, which asks whether users or developers mistakenly treat the model as if it understands intent or reasons like a person, and non-explainability, which highlights the difficulty of justifying an LLM's output when it screens résumés, evaluates medical images, or makes business decisions.
"AI didn't break threat modeling. It exposed weaknesses that were already there," says Jeff Williams, founder of OWASP and CTO of Contrast Security, in the report. Williams argues that threat modeling has never been standardized or automated enough to scale, and the hardest challenge isn't naming threats but figuring out which applications actually work, a process traditionally handled through surveys, interviews, and outdated diagrams. Brian Glas, vice president of consulting services at CODIFIC and a project lead for the OWASP Top 10, notes that traditional threat modeling applied to deterministic systems, while modern generative and agentic AI systems are non-deterministic, requiring modified risk profiles. The report emphasizes that the biggest mistake organizations make is forgetting that existing risks still apply—teams shouldn't jump to prompt injection or model manipulation while skipping fundamentals like identity controls, API security, and handling of untrusted input.
The framework aims to help CISOs decide quickly whether a risk is acceptable, whether the system needs changes, or whether deeper review is necessary. Short sessions allow teams to iterate faster, and if the first attempt misses the mark, they can start over without losing days or weeks of work. Shostack says making experiments inexpensive enables repeated runs, a lesson borrowed from agile development. Williams warns that focusing heavily on novel AI threats while ignoring basics leaves organizations exposed to preventable vulnerabilities, and traditional application security must remain the foundation with AI risks layered on top, not replacing it. Glas adds that details have changed but fundamentals of risk have not, advising teams not to abandon 25 years of security lessons in pursuit of speed. The bottom line: organizations need practical entry points for AI threat modeling that balance urgency with thoroughness, and brief, focused sessions can uncover enough meaningful risks to guide decisions without becoming paralyzing. As AI systems grow more capable and autonomous, the pressure to secure them quickly will only intensify, yet rushing past conventional safeguards in favor of exotic new threats may prove the costliest mistake of all.