Both STRIDE and EMB3D model the analyst as a fixed-capability node. That falls apart fast in any SOC running AI-flagged alerts. MDPI ran a survey of 500 cybersecurity decision-makers (Computers 13(7):165, 2024): 35% missed alerts, 22% ignored them, 25% didn't act on high-profile ones. Threat models that don't price in analyst degradation under AI augmentation are underestimating operator-layer risk in a way that gets worse the more AI you deploy.
Both STRIDE and EMB3D model the analyst as a fixed-capability node. That falls apart fast in any SOC running AI-flagged alerts. MDPI ran a survey of 500 cybersecurity decision-makers (Computers 13(7):165, 2024): 35% missed alerts, 22% ignored them, 25% didn't act on high-profile ones. Threat models that don't price in analyst degradation under AI augmentation are underestimating operator-layer risk in a way that gets worse the more AI you deploy.