International · Threat modelling method
CSA MAESTRO: threat modelling for agentic AI
MAESTRO (Multi-Agent Environment, Security, Threat, Risk, and Outcome) is a threat modelling framework for agentic AI, published by the Cloud Security Alliance on 6 February 2025 and written by Ken Huang. It breaks an agentic system into seven layers, from foundation models to the agent ecosystem, and looks for threats within each layer and across the boundaries between them.
In the FairMind catalogue: 7 requirements mapped to 46 workflows and 2 evaluations.
Source: Cloud Security Alliance: Agentic AI Threat Modeling Framework: MAESTRO
CSA MAESTRO: what it asks of AI systems
The parts most relevant to governing AI systems and agents, summarised from the CSA MAESTRO agentic AI threat modelling framework.
- L1Foundation models
- The core models agents run on, with threats such as adversarial inputs, model theft and backdoors.Mapped to: AI inventory and intake, Threat modelling, guardrails and vulnerabilities
- L2Data operations
- The data, stores and retrieval pipelines agents use, with threats such as poisoning and exfiltration.Mapped to: Data governance and provenance, Threat modelling, guardrails and vulnerabilities
- L3Agent frameworks
- The frameworks used to build agents, with threats such as compromised components and input validation flaws.Mapped to: Agent identity, access and permission bounding, Responsible design and secure development, Threat modelling, guardrails and vulnerabilities
- L4Deployment and infrastructure
- The infrastructure agents run on, with threats such as compromised containers and lateral movement.Mapped to: Responsible design and secure development, Threat modelling, guardrails and vulnerabilities
- L5Evaluation and observability
- Monitoring and evaluation of agent behaviour, with threats such as manipulated metrics and evasion of detection.Mapped to: Evaluation and testing, FairMind agent self-assurance, Human oversight and intervention, Monitoring and logging, Threat modelling, guardrails and vulnerabilities
- L6Security and compliance
- A vertical layer across all the others, covering security controls and regulatory compliance.Mapped to: Monitoring and logging, Threat modelling, guardrails and vulnerabilities
- L7Agent ecosystem
- Where agents meet users, tools and other agents, with threats such as impersonation and untrusted agents.Mapped to: AI inventory and intake, Accountability and oversight bodies, Agent identity, access and permission bounding, Responsible design and secure development, Threat modelling, guardrails and vulnerabilities
Evidence FairMind helps you produce
FairMind links technical evidence to CSA MAESTRO obligations for a human reviewer to accept. It is not legal advice and does not decide compliance.
- An agent threat model and taint trace per agent and multi-agent system
- Runtime guardrail reviews and red-teaming results linked to the layer they cover
- Inter-agent trust reviews for systems where agents call other agents
- Agent activity monitoring and evaluation records for the observability layer
CSA MAESTRO questions
What does MAESTRO add to existing threat models?
Layers specific to agentic systems and attention to threats that cross layers, such as a poisoned data store that changes what an agent does with its tools. It can be used alongside general methods your team already runs.
How does FairMind use MAESTRO?
The catalogue maps all 7 layers to 10 common controls and 46 workflows. A person approves every threat model and finding at the gate before it is filed.