MoreSec STAC

STAC (Threat Modeling Analysis System) is a threat modeling tool from MoreSec designed for the requirements and design stages of the secure software development lifecycle (SDL/DevSecOps). The system uses AI algorithms and RAG (retrieval-augmented generation) technology to parse uploaded requirement documents and automatically generate threat modeling analyses. It matches business requirements against a knowledge base containing security requirements, security design patterns, industry standards, threat intelligence, application scenarios, and test cases to produce threat models aligned to specific business scenarios. The product collects project information through a questionnaire covering compliance requirements, scenario needs, design architecture, middleware, external exposure surfaces, and system importance level, which is used as input for the threat analysis. Output is a structured threat modeling report intended to communicate security risk across development and security teams early in the design phase. STAC integrates with MoreSec's IAST product to automatically test and validate whether identified security requirements and designs have been implemented. It also visualizes project-level security analysis, identifies common threats and security requirements across projects, and abstracts these into reusable top-level security architecture designs. The knowledge base can be customized and updated, and has been built from threat modeling practices across industries including banking, manufacturing, energy, and aerospace.