Cloud Security Alliance releases MAESTRO framework to threat-model AI agents

The Cloud Security Alliance (CSA) has published MAESTRO, a structured threat-modeling framework designed specifically for agentic AI systems. Authored by Ken Huang of CSA's AI Safety work, MAESTRO stands for Multi-Agent Environment, Security, Threat, Risk, and Outcome. The framework breaks down an AI agent into seven layers — including foundation models, data operations, agent frameworks, and deployment infrastructure — allowing security teams to systematically identify vulnerabilities at each level. Unlike older methods such as STRIDE or PASTA, MAESTRO accounts for AI-specific risks like prompt injection, poisoned training data, and autonomous actions that no one explicitly scripted. CSA has also released a companion Agentic AI Red Teaming Guide that uses the same seven-layer structure to support hands-on security testing.