ThreatModeler launches NexusAI: agentic AI that keeps threat models alive as code ships

• Who: ThreatModeler — an AI-powered threat modeling and continuous security intelligence company; CEO Kevin Gallagher.
• What: NexusAI, an AI-powered threat-modeling partner within the ThreatModeler Nexus platform, bringing agentic automation to threat modeling.
• When: announced October 20, 2026 via PRNewswire.
• The three automations: create threat models from natural language, diagrams, documentation, and existing application context; identify threats, security requirements, and risks with AI-powered analysis and recommendations; detect architectural changes and propose threat model updates for human review.
• The core tech: the Secure Design Graph, which connects application architecture, threats, requirements, mitigations, and security decisions so teams build on existing knowledge instead of starting from scratch.
• Background: the launch follows the combination of ThreatModeler and IriusRisk earlier in 2026 and the introduction of the unified ThreatModeler Nexus platform in July; ThreatModeler says it is backed by 14 patents.

Threat modeling has always been the security step that happens once and then slowly rots. Today, ThreatModeler is betting agentic AI can keep it alive: the company announced the launch of NexusAI, an AI-powered threat-modeling partner inside the ThreatModeler Nexus platform that automates the heavy lifting of creating, analyzing, and maintaining threat models — while keeping security experts in control of critical decisions.

The pitch lands at a moment when AI-accelerated development is widening the gap the product is named for. As AI writes more of the world's code, security teams face growing pressure to assess more applications, respond to architectural changes, and manage risk without slowing innovation. NexusAI is ThreatModeler's answer: agentic automation that works within the development flow instead of outside it.

What NexusAI automates

The release frames the product around three automations. First, threat model creation: generate and explore threat models using natural language, diagrams, documentation, and existing application context — no blank-canvas sessions. Second, security analysis: identify relevant threats, security requirements, and risks with AI-powered analysis and recommendations. Third, and most distinctively, keeping pace with development: identify architectural changes and propose threat model updates for human review, cutting the ongoing maintenance work that turns threat models into shelfware.

The Secure Design Graph

Under the hood, NexusAI is powered by the Secure Design Graph — the core of the ThreatModeler Nexus platform, which connects threat modeling with organizational security knowledge and development workflows. The graph links application architecture, threats, requirements, mitigations, and security decisions, letting teams build on existing knowledge rather than starting from scratch.

Through integrations with development tools, the platform brings threat modeling closer to where software is built: security teams keep oversight while developers get relevant security guidance inside their existing workflows. ThreatModeler describes the Secure Design Graph as a dynamic system of record — capturing architecture, security decisions, mitigations, and organizational knowledge — that grows smarter with every application.

A follow-up to the IriusRisk combination

The launch follows the combination of ThreatModeler and IriusRisk earlier in 2026 and the introduction of the unified ThreatModeler Nexus platform in July — making NexusAI the next step, in the company's telling, toward enterprise threat modeling that is more automated, connected, and scalable.

“Generating a threat model with AI is only the beginning,” said Kevin Gallagher, CEO of ThreatModeler. “The real opportunity is making that intelligence useful long after the first model is created. With NexusAI, we’re connecting threat modeling to development and building on the security knowledge organizations already have, so security becomes smarter, more consistent, and more valuable over time.”

The company's positioning is enterprise-first: backed by 14 patents, with threat modeling aimed at scaling across thousands of applications rather than one-off engagements. Whether agentic threat modeling closes the gap between development speed and s