Autonomous Threat Modeling — Claude Code Agent Teams Demo

What I Built

Agent Teams for
security assessment.

Claude Code Agent Teams lets you orchestrate multiple Claude Code sessions working together. One session acts as the team lead, coordinating work and spawning teammates — each a full Claude Code instance with its own context window, running in parallel.

I built nine specialized agents and a custom threat modeling skill on top of this. The team lead orchestrates an eight-phase assessment pipeline — spawning the right specialist for each phase, coordinating via shared task lists and inter-agent messaging, and consolidating everything into a multi-format report.

The entire output — architecture diagrams, 26 findings with OWASP risk scores, compliance mappings across four frameworks, privacy analysis, and a remediation roadmap — is produced without a single human edit.

Why Agent Teams?

Unlike sub-agents that only report back to a parent, Agent Teams teammates message each other directly, share discoveries mid-task, claim work from a shared task list, and coordinate without a human intermediary. Each teammate loads project context and the custom skill but operates in its own context window.

👑

Team Lead (Orchestrator)

Spawns teammates, assigns phases, synthesizes results

🏗️

Specialist Teammates

Security architect, diagram, GRC, privacy, code review agents

⚙️

Threat Model Skill

Custom skill encoding STRIDE-LM + PASTA + OWASP methodology

📋

Shared Task List

Dependency-tracked tasks with automatic claim & coordination

✉️

Inter-Agent Messaging

Teammates message the lead and each other directly

Under the Hood

How the agents
coordinate.

Three views of the orchestration system — from high-level architecture to the step-by-step execution pipeline and full component map.

System Architecture — Parent conversation orchestrating Core Pipeline, Specialist Agents, Post-Processing, Shared Filesystem, and Reference Files

Parent orchestrator spawns core agents (sequential), specialist agents (parallel), and post-processing (sequential). All share a filesystem and consult institutional reference docs.

Pipeline Flow — Solo vs Team decision tree with sequential and parallel execution paths

Solo path for simple systems, Team path for complex ones. Team mode forks 3 specialists in parallel, joins results, validates, then generates 4 report formats.

Component Map — Skill files, 7 agent definitions, Mermaid diagram system, and output structure

The full component inventory: 1 custom skill, 11 reference files (including 6-file Mermaid diagram system), 7 agent definitions, and structured output directory.

Architecture

Eight phases,
nine agents.

The team lead orchestrates each phase, spawning the right specialist. Every agent runs Claude Opus 4.6 with Extended Thinking.

01

🔍

Recon

security-architect

02

📐

Structure Diagram

diagram-specialist

03

🎯

Threat ID

security-architect

04

⚖️

Risk Scoring

security-architect

05

🔬

False Neg Hunt

security-architect

06

✅

False Pos Review

security-architect

07

🗺️

Risk Overlay

diagram-specialist

08

📊

Report Gen

report-analyst

🏗️

Security Architect

Core threat modeling specialist. Recon, threat identification, risk quantification, false positive/negative analysis.

Phases 1, 3–6

📐

Diagram Specialist

Generates L1 structural architecture and L4 risk overlay diagrams with kill chain mappings.

Phases 2, 7

📊

Report Analyst

Consolidates all outputs into HTML, PDF, DOCX, and PPTX with executive summaries.

Phase 8

🔍

Security Reviewer

Deep-dive code reviews and configuration audits across IaC, containers, and CI/CD.

Review

🛡️

GRC Agent

Maps findings to SOC 2, ISO 27001, NIST CSF 2.0, PCI-DSS v4.0 with coverage metrics.

Compliance

🔐

Privacy Agent

LINDDUN-based privacy analysis — data flow violations, deceptive patterns, missing controls.

Privacy

✓

Validation Specialist

Cross-checks accuracy, validates severity scores, deduplicates, ensures consistency.

QA

💻

Code Review Agent

Source code vulnerability analysis, insecure patterns, dependency risks.

Code

⭐

Code Quality Reviewer

Code quality, maintainability, and secure coding practices assessment.

Quality

Claude Opus 4.6 — all agents

Extended Thinking — enabled

Agent Teams — team coordination

Custom Skill — threat model methodology

Methodology

Multi-framework
threat analysis.

The custom skill encodes industry-standard frameworks into every agent's workflow — automated risk scoring and compliance mapping baked in.

STRIDE-LM

Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege — plus Lateral Movement.

PASTA

Process for Attack Simulation and Threat Analysis — risk-centric, attacker-focused methodology.

OWASP Risk Rating

Likelihood × Impact (1–5) producing 1–25 risk scores mapped to severity bands.

LINDDUN

Linkability, Identifiability, Non-repudiation, Detectability, Disclosure, Unawareness, Non-compliance.

Sample Assessment

26 findings.
2 critical.

OVERALL POSTURE: CONCERNING

Assessment of an AWS ECS Fargate demo application deployed via Terraform. Severity distribution reveals significant security gaps across infrastructure, CI/CD, and application layers.

2

Critical

10

High

11

Medium

3

Low

ID	Severity	Title	Score
TM-004	Critical	Repository-Sourced Buildspec + Broad IAM	25
TM-003	Critical	IAM PassRole Wildcard (*)	20
TM-023	High	No Branch Protection	16
TM-013	High	CodeBuild Privileged Docker	16
TM-014	High	No Pipeline Approval / Scanning	16
TM-001	High	No TLS/HTTPS on ALBs	15
TM-002	High	No Authentication/Authorization	15
TM-005	High	GitHub Token in TF State	15
TM-006	High	Mutable ECR Tags + Latest	15
TM-007	High	No WAF or Rate Limiting	12
TM-022	High	Unrestricted ECS Egress	12
TM-024	High	No Billing Alarm	12
TM-009	Medium	S3 Missing Security Controls	9
TM-011	Medium	No VPC Flow Logs	9
TM-015	Medium	Outdated Dependencies	9
TM-017	Medium	Container Hardening Deficiencies	9
TM-012	Medium	Error Handler Info Leakage	8
TM-025	Medium	npm install vs npm ci	8
TM-008	Medium	Unrestricted CORS	6
TM-018	Medium	Single NAT GW (SPOF)	6
TM-021	Medium	No Container Insights	6
TM-026	Medium	No CloudTrail Data Events	6
TM-016	Medium	Swagger Publicly Exposed	5
TM-010	Low	DynamoDB No PITR/CMK	4
TM-019	Low	No VPC Endpoints	4
TM-020	Low	SNS No Subscribers/Encryption	3

Compliance Coverage

Framework
mapping.

Each finding is automatically mapped to relevant controls across four major compliance frameworks, generating coverage metrics.

SOC 2

9%

3 compliant · 6 partial · 22 non-compliant

ISO 27001

10%

5 compliant · 8 partial · 41 non-compliant

NIST CSF 2.0

8%

4 compliant · 9 partial · 38 non-compliant

PCI-DSS v4.0

2%

1 compliant · 3 partial · 48 non-compliant

Sample Output

What the agents
produce.

Demo target: an AWS ECS Fargate reference architecture deployed via Terraform. Four deliverables, zero human edits.

🌐

Interactive HTML

Full report with sidebar nav, search, interactive diagrams, and expandable findings.

AutonomousThreat Modeling

Agent Teams forsecurity assessment.

How the agentscoordinate.

Eight phases,nine agents.

Multi-frameworkthreat analysis.

STRIDE-LM

PASTA

OWASP Risk Rating

LINDDUN

26 findings.2 critical.

Frameworkmapping.

SOC 2

ISO 27001

NIST CSF 2.0

PCI-DSS v4.0

What the agentsproduce.

Autonomous
Threat Modeling

Agent Teams for
security assessment.

How the agents
coordinate.

Eight phases,
nine agents.

Multi-framework
threat analysis.

26 findings.
2 critical.

Framework
mapping.

What the agents
produce.