What changed in threat modeling in 2026

A threat model written in 2023 describes a system that, by 2026, delegates work to agents, pulls tools over the Model Context Protocol, and authenticates with identities nobody has inventoried. The threats in that model are still plausible. The system is not the one it describes.

That gap is the story of the year. Threat modeling did not get a new framework; it got new obligations, a new attack surface, and a new delivery model. Here is what actually changed, and what it means for the next two quarters.

The model became evidence

The EU Cyber Resilience Act (Regulation 2024/2847) turned risk assessment from good practice into a documented legal obligation for products with digital elements sold in the EU. Reporting duties began on 11 September 2026. The broader manufacturer obligations — risk assessment, secure design, vulnerability handling, technical documentation, SBOMs, conformity assessment — apply from 11 December 2027 for products placed on the market after that date. Penalties reach €15 million or 2.5% of worldwide turnover, whichever is higher.

The CRA does not mandate a methodology. Its official FAQ says manufacturers choose their own, but the one they choose must document how risks were identified, evaluated, and mitigated, and the threat modeling must reflect the product’s intended purpose and reasonably foreseeable use. A consumer app and a critical-infrastructure component are expected to carry different threat models.

The practical consequence: a model that lives in a slide deck and is never versioned is now a compliance liability. The artifact matters as much as the analysis.

The workshop became a pipeline

The 2026 application-security outlook describes threat modeling moving from an optional design step to a continuous part of the lifecycle, driven by regulatory pressure, faster architecture change, and agentic systems. The reasoning is simple: if the architecture changes weekly and the model changes annually, the model is a historical document.

The community data shows how far most teams are from that. In the State of Threat Modeling 2024–25 report, based on 60+ organizations, 74% said creating system diagrams was mandatory and 37% named diagrams as the main source for generating threats. Diagrams are also the first artifact to go stale. The report is community-run and self-selected, so treat the numbers as directional, not universal.

AI is early, not magic

The same report found only 7% of companies using AI in threat modeling regularly, with 40% using it occasionally. That was 2024–25 data; the number is almost certainly higher now. The interesting gap is not generation. It is review.

Generating plausible threats is becoming cheap. Deciding which ones matter, attaching evidence, and accepting the risk is not. A model that cannot show its assumptions, its sources, and the human decision behind each mitigation is a draft, not a record.

Agentic AI broke the old assumptions

OWASP published its Top 10 for Agentic Applications 2026 in December 2025. The list maps how the threat model changes: agent goal hijack, tool misuse, identity and privilege abuse, supply-chain weaknesses in tools and MCP servers, unexpected code execution, memory and context poisoning, insecure agent-to-agent communication, cascading failures, human trust exploitation, and rogue agents.

MITRE ATLAS release 2026.09 tracks the corresponding techniques, and OWASP’s Agentic AI Threats and Mitigations guide (T1–T17) provides the narrative. A public mapping between the two is already in use as a shared vocabulary across teams.

The UK NCSC’s position is worth quoting in any design review: prompt injection may never be fully mitigated the way SQL injection can be, so the goal is impact reduction, not just prevention.

The modeling consequence: data-flow diagrams are no longer sufficient. You have to model what each agent can do — its tools, its data, its permissions, its delegation chain — and what happens when one of those is manipulated. Identity is the boundary now, not the network.

The tooling market consolidated

In January 2026, ThreatModeler acquired IriusRisk in a deal reported at over $100 million. Two of the best-known threat modeling platforms became one. Expect bundling, platform pressure on point tools, and a buyer’s market for “threat modeling plus ASPM plus compliance” suites.

That is not automatically good for buyers. The artifact and the method matter more than the logo on the tool. Consolidation raises the value of models that are portable: open formats, versioned output, and evidence that survives a vendor change.

What did not change

STRIDE remains the dominant vocabulary: 88% of respondents in the community report align to it. Human judgment still decides which threats matter. And threat modeling is still a design activity — the part that needs a person who understands the system, not a generator that produces two hundred plausible sentences.

What to do in the next two quarters

Inventory your agents. For each: owner, tools, data, permissions, delegation, and what it can change. If you cannot answer that, you cannot threat model it.
Model identity and delegation, not just data flow. The OWASP agentic risks are mostly identity and tool-permission risks in disguise.
Tie the model to change. Re-model when the architecture changes, not on an annual cadence. A model without a diff has no credibility.
Produce evidence. Version the model, record assumptions and decisions, attach owners and mitigations, and keep the output portable.
Decide what AI does. Let it draft, summarize, and map; require a human to approve risk decisions. Document that split.

If you sell into the EU, add one more: map the model to the CRA’s risk-assessment and technical-documentation expectations now, not in 2027.

For how we approach the continuous version of this — architecture in, threats out, re-modeled on change — see the Threat Model Agent.