MAESTRO — the architecture behind the threats.
A threat catalogue names what can go wrong. MAESTRO names where in a running agentic system each failure lives.
MAESTRO — Multi-Agent Environment, Security, Threat, Risk, and Outcome — is a threat-modeling framework published by the Cloud Security Alliance for agentic AI systems. It organizes a multi-agent deployment into seven architectural layers plus one that cuts across them, and asks, at each layer, which components of a running system need scrutiny. Here it is a second lens over the same 15 agentic threats: the security overview groups them by where an attack enters; MAESTRO groups them by which architectural layer owns the failure.
Why MAESTRO, and not STRIDE or PASTA
General-purpose threat-modeling frameworks were built for deterministic software. Agentic systems break five of their assumptions at once — autonomous, non-deterministic decisions; adversarial machine-learning attacks on the model itself; emergent multi-agent interaction and collusion; goal misalignment; and an AI-specific supply chain of models, datasets, and tools. MAESTRO exists to cover exactly those gaps.
STRIDE
FocusMicrosoft's threat-category mnemonic (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) for software components.
The agentic gap it leavesAssumes a static, deterministic component graph — no model for agent autonomy, adversarial ML, or emergent multi-agent behavior.
PASTA
FocusRisk-centric, seven-stage process aligning business objectives with technical threats.
The agentic gap it leavesIts stages presuppose a designed, predictable system; it does not model autonomous decision-making or ML-specific attack surfaces.
LINDDUN
FocusPrivacy threat modeling (Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, Non-compliance).
The agentic gap it leavesScoped to privacy; silent on agent autonomy, tool misuse, and multi-agent security.
OCTAVE
FocusOrganizational, asset-driven risk assessment (operationally critical threat, asset, and vulnerability evaluation).
The agentic gap it leavesOperates at the strategic/organizational level, not the technical agentic runtime; no ML or agent-behavior threats.
Trike
FocusRequirements-and-audit risk model built on actor–asset–action matrices.
The agentic gap it leavesManual and deterministic; does not scale to autonomous, unpredictable agents or emergent interaction.
VAST
FocusVisual, Agile, Simple threat modeling that scales across enterprise DevOps via process/application flow diagrams.
The agentic gap it leavesBuilt for traditional software pipelines; no coverage of agent autonomy, adversarial ML, or multi-agent collusion.
A reference architecture, single agent and multi-agent
The same 15 threats — two lenses
The security overview groups the threats by where an attack enters; MAESTRO by which architecture layer owns the failure. Hover a threat — it lights up in both lenses, and its placement appears above.
By attack surface
The trust-and-data flow through an agent defines five attack surfaces. In a MAS the Inter-Agent surface carries the most threats — it exists only because agents delegate to and trust one another.
Everything the system reads — user prompts and untrusted content an agent ingests — where injection enters.
Persistent state and retrieved context, where poisoned memory biases every later decision.
The tools and external data an agent calls, where misuse and poisoned results turn reach into risk.
Messages between agents, where a poisoned or spoofed peer propagates compromise across the system.
What the system emits or actuates, where unvalidated output and excessive agency cause real-world harm.
By MAESTRO layer
Each threat sits where its failure is owned — from the Foundation Model up to the Agent Ecosystem, plus one layer that cuts across all of them. Some touch several layers.
Foundation Model
Whether the underlying model and its training data can be trusted — resistant to poisoning and consistent with its intended alignment.
Data Operations
The integrity of vector stores, retrieval pipelines, and the prompt assembly that feeds an agent's working context.
Agent Frameworks
The execution logic, workflow control, and autonomy boundaries that govern how an agent plans and acts.
Deployment & Infrastructure
Runtime and container security, orchestration, networking, and the MLSecOps pipeline an agent runs on.
Evaluation & Observability
Monitoring, alerting, logging, and the human-in-the-loop interfaces that make agent behavior legible.
Security & Compliance
Access control, policy enforcement, and the regulatory constraints an agent must operate within.
Agent Ecosystem
How an agent interacts with humans, external tools, and other agents across the wider ecosystem it participates in.
A concrete cascade: an attacker exploits a vulnerability in the container infrastructure (Layer 4 — Deployment & Infrastructure) and gains access to a running agent instance; from there they inject malicious data into the agent's data store (Layer 2 — Data Operations), which poisons the next model update and so compromises the foundation model (Layer 1). One cause, three layers.
The MAESTRO workflow
MAESTRO prescribes a six-step workflow that applies the seven-layer architecture to a concrete deployment and iterates as the system evolves.
System decomposition
Break the system into components along the seven layers; define each agent's capabilities, goals, and interactions.
Layer-specific threat modeling
Walk each layer's own threat landscape and tailor the identified threats to the specifics of the system.
Cross-layer threat identification
Analyze the interactions between layers and trace vulnerability cascades that no single layer surfaces on its own.
Risk assessment
Assess each threat's likelihood and impact and prioritize with a risk matrix.
Mitigation planning
Plan layer-specific, cross-layer, and AI-specific mitigations for the prioritized threats.
Implementation and monitoring
Implement the mitigations, monitor continuously for new threats, and update the threat model as the system changes.
Security