Don't Bury the Model T: Why STRIDE Still Drives in an AI World

Do AI systems require a new threat-modeling method, or are we abandoning useful tools before understanding their limits? Chris Romeo, Izar Tarandach, and Matt Coles first examine npm's move toward safer install defaults and the risk that agents trained on older behavior will simply re-enable dangerous options. Then they debate the claim that STRIDE belongs to a world that no longer exists. The discussion separates threat categories from modeling techniques, non-deterministic model behavior from deterministic controls, and unfamiliar failures from familiar security responsibilities. The Model T analogy gives both sides something to argue with: an older framework may need adaptation, but declaring it obsolete does not explain how the replacement improves the analysis.

Mentioned in this Episode:
➜ npm install documentation
➜ Microsoft Threat Modeling Tool: STRIDE threats

Chapters:
00:00:00 - Intro: deterministic fans
00:01:32 - npm and secure install defaults
00:03:22 - Will AI agents re-enable risky behavior?
00:05:35 - Other package managers and safe defaults
00:10:02 - Checking packages and internal repositories
00:15:26 - Let's Encrypt and code-signing certificates
00:20:04 - Install scripts and compatibility
00:25:05 - The search for the wheat color
00:27:34 - Was STRIDE built for a vanished world?
00:30:04 - Threat categories and modeling methods
00:35:19 - Non-deterministic AI and deterministic controls
00:40:15 - Hallucination and cross-context failures
00:45:04 - STRIDE and the Model T analogy
00:50:34 - Tracing code versus explaining model behavior
00:55:46 - Closing assessment

Follow AI Security Table:

➜ Home: https://securitytable.ai/

➜ X: https://x.com/SecTablePodcast

➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/

➜ YouTube: https://www.youtube.com/@AISecurityTable