A Threat Modeling Prioritization and Automation Framework for Composable Architectures

Abstract

Organizations face escalating cyber risk, expanding attack surfaces, increasingly automated adversaries, and constrained security resources. Organizations are looking for practical mechanisms to improve security resilience by transforming threat modeling from a periodic design activity into a continuous, evidence-driven decision process. This paper offers a snapshot of the literature review of the threat modeling for composable architectures, shows why automation is difficult in this context, and proposes an automation framework to allocate scarce resources according to risk exposure to composable architecture components, where applications, services, identities, data flows, and autonomous agents are assembled and reconfigured across distributed environments. Composable architecture shows in an amplified way the gap between the static and dynamic security approaches, and our proposal helps to define the attributes needed for setting automation boundaries at the service level for risk prioritization based on threat modeling for security remediation actions. The conceptual framework integrates Zero Trust principles, control-effectiveness measurement, and human-in-the-loop governance and examines how automation with artificial intelligence changes the threat landscape by introducing risks that are difficult to measure and fast-changing. The results show that automation should be controlled with defined boundaries explained through measurable attributes for transparent decisions. It also proposes that AI should not replace expert judgement; rather, it should augment security teams by improving information quality, revealing hidden dependencies, supporting adaptive prioritization under uncertainty, and enabling resilience-oriented investment decisions for composable, distributed, and increasingly autonomous systems.