How We Cut Enterprise Threat Modeling Time by 96% Using AWS Generative AI

The Security Bottleneck No One Talks About

For fast-growing technology companies, security should be a competitive advantage — not a bottleneck. Yet for many enterprises, threat modeling remains one of the most time-consuming steps in the software development lifecycle.

At one of our fintech clients in Asia-Pacific, the situation was critical. With over 200 engineers shipping new features across a complex financial platform, each threat modeling review required 8 to 12 weeks of senior security engineer time. The backlog was growing. Releases were slowing. And the security team had no realistic path to scale.

They came to JediHill with a clear challenge: automate threat modeling without compromising quality — and do it entirely within their own AWS environment.

Why "Just Use a Third-Party AI Tool" Wasn't an Option

The obvious answer — send the PRDs to an external AI API — was immediately off the table. As a regulated financial institution handling sensitive product design documents, the client operated under strict data residency requirements. No proprietary data could leave their environment.

This constraint actually led to a better architecture. By deploying entirely on AWS Bedrock, we kept every LLM inference call within the customer's own AWS account. No data egress. Full regulatory compliance. And significantly lower cost — AWS Bedrock (Claude 3 Haiku) runs at approximately 95% lower cost than comparable external AI APIs.

The Solution: An AWS-Native AI Threat Modeling System

JediHill designed and deployed a production-grade, AI-powered threat modeling platform built entirely on AWS. Here's how it works:

Step 1 — Upload Security engineers or product managers upload a Product Requirements Document (PRD) via the web interface. The file is stored in Amazon S3, which immediately triggers the analysis pipeline.

Step 2 — Async Processing An AWS Lambda function activates an SQS-based workflow, ensuring the system handles large documents and concurrent requests without timeout issues. A second Lambda orchestrates the analysis job and reports status back in real time.

Step 3 — Two-Step LLM Analysis (ECS Fargate + AWS Bedrock) The core analysis runs in a FastAPI service on AWS ECS Fargate:

• Pattern Matching: The LLM scans each PRD section against a proprietary 15-pattern threat library covering STRIDE categories, business logic abuse patterns, and domain-specific financial risks.

• Threat Generation: Matched patterns drive detailed threat entry generation — including attack methods, STRIDE classification, risk scores (Low / Medium / High / Critical), and mitigation recommendations.

  
  

Step 4 — Results Generated threat models are stored in Amazon DynamoDB, surfaced through the web dashboard, and exportable as structured reports. AWS Translate enables multilingual support for international teams.

(Architecture diagram below)

The Results

The impact was measurable from the first week of production deployment:

• ⏱ 96% reduction in threat modeling cycle time — from 8–12 weeks to under 4 hours per PRD

• 🧑‍💻 92% reduction in security engineering effort — freeing approximately 1,200 engineer-hours per year

• 🔒 Zero data egress — all LLM inference runs within the customer's own AWS account

• 📦 Full IaC ownership transferred — six Terraform modules delivered and handed over at engagement close, enabling the team to independently manage and extend the system

  
  

What Made the Difference

1. AWS Bedrock-native from day one. We didn't retrofit data residency compliance — we designed for it. Bedrock's managed model access meant no infrastructure to manage for LLM serving, and model access could be audited and controlled through standard AWS IAM policies.

2. Infrastructure as Code, not a black box. Every component — VPC, ECR, IAM roles, Secrets Manager, ALB, ECS Fargate cluster — was provisioned through Terraform and fully documented. The client team owns the system outright.

3. Asynchronous architecture for production scale. The SQS + Lambda + ECS design means the platform handles concurrent analysis jobs gracefully, with no ALB timeout risk and real-time status visibility for users.

What's Next

The client is now exploring CI/CD pipeline integration for automated per-commit threat scanning, expansion of the pattern library to cover PCI-DSS and MAS TRM compliance frameworks, and a Bedrock Guardrails implementation for enhanced responsible AI controls.

Ready to Automate Security Reviews at Your Organisation?

JediHill helps enterprises in financial services, healthcare, and SaaS harness AWS Generative AI to solve real engineering bottlenecks — built to production standards, running in your own account, delivered with full IaC ownership.

📩 Get in touch: www.jedihillatlas.com | hello@jedihillatlas.com