ThreatForest

---

ThreatForest is an agentic threat modeling platform built on the Strands agent framework. Point it at a repository and it autonomously generates attack trees, maps attack steps to MITRE ATT&CK techniques, and produces actionable mitigation recommendations.

Built for security teams, architects, and DevSecOps engineers who want to bring threat modeling into the development loop without turning it into a second full-time job.

• 🤖 Autonomous agent pipeline — scanner, threat identifier, attack tree generator, TTP mapper, and mitigation advisor run in sequence, analyzing threats in parallel
• 🛡️ MITRE ATT&CK mapping — attack steps are mapped to TTPs using ATTACK-BERT semantic embeddings
• 📊 Interactive dashboard — explore threats visually with a searchable graph, filters, and expandable mitigations

Privacy: ThreatForest sends project context to your configured LLM provider. AWS Bedrock is recommended for production workloads.

Quick Start

git clone https://github.com/aws-samples/sample-agentic-attack-tree-generator.git
cd sample-agentic-attack-tree-generator

# 1. Embeddings / MITRE TTP matching run in a small Python service
uv sync
uv run python -m ml_service          # binds 127.0.0.1:8770 — leave running

# 2. The pipeline, API, CLI and UI are TypeScript
cd ts
npm install
npm run dev                          # ML service + API (:8000) + UI (:3000)

Then open http://localhost:3000.

The Python ML service is required — the engine pre-flights it and refuses to start a run when it is unreachable, rather than producing a threat model with silently missing attack paths.

See the Getting Started guide for full installation options and configuration.

See it in action

From a repository path to a fully mapped attack tree in a single run. For a deeper tour — including the dashboard, filtering, and mitigation details — see the full walkthrough in the docs.

Next steps

• 📚 Read the documentation — full guides, architecture, and FAQ
• 🏗️ How it works — the agent pipeline, phase by phase
• 🐛 Report an issue — bug reports and feature requests welcome
• 🤝 Contribute — see the contributing guide to get involved

Star history

Citation

ThreatForest is described in ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping. If you use it in your research, please cite:

@misc{leo2026threatforest,
  title         = {ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping},
  author        = {Leo, Cristian and Dykyi, Anton and Cortegaca, Danny and Begimher, Daniel and Jha, Prakash},
  year          = {2026},
  eprint        = {2607.27528},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CR},
  url           = {https://arxiv.org/abs/2607.27528}
}

License

MIT — see LICENSE.