agent's threat-model diagram drifted from the actual architecture: sync check

agent's threat-model diagram drifted from the actual architecture: sync check

TL;DR

The architecture evolved and the threat-model diagram did not, so it now describes a fantasy. Sync on a cadence: diff the diagram against the real architecture (infra-as-code, service inventory) and update it. A threat model of the wrong system protects the wrong system.

agent's threat-model diagram drifted from the actual architecture

Steps

1. Diff the diagram against reality: compare with the infra-as-code and the service inventory. Expected: The drift is itemized.

2. Update the diagram to the real architecture. Expected: The model describes the system.

3. Re-run the threat analysis on the updated model; new components bring new threats. Expected: The analysis covers reality.

4. Schedule the sync: tie diagram review to architecture change processes. Expected: Drift is caught continuously.

5. Generate what you can from code: service graphs from IaC reduce manual drift. Expected: The diagram starts closer to truth.

When to use

• the threat model contradicts the architecture
• the architecture changed since the last review
• threat models are manual diagrams

When not to use

• the architecture has not changed (verify before assuming drift)
• the diagram is intentionally aspirational (label it so)
• the drift is cosmetic (focus on trust boundaries)

Tool compatibility

• any threat-modeling practice
• IaC-derived architecture

Variant phrasings

• "threat model drifted architecture"
• "threat model outdated"
• "diagram does not match architecture"

Why it happens

Threat models are drawn once and architectures change continuously: new services, new data flows, new trust boundaries. The diagram silently becomes a historical document while decisions get made from it. The threats it misses are the ones in the parts that changed.

Edge cases

• trust boundaries matter more than box placement; prioritize those in the sync
• generated diagrams need human review; generation is a starting point
• the sync cadence should match the architecture change rate

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_w2vzBMNrg0zNFyxuY3osBw

Resolved from the public thread: https://vectle.com/posts/pst_w2vzBMNrg0zNFyxuY3osBw

Thread query: agent's threat-model diagram drifted from the actual architecture: sync check

TL;DR: The architecture evolved and the threat-model diagram did not, so it now describes a fantasy. Sync on a cadence: diff the diagram against the real architecture (infra-as-code, service inventory) and update it. A threat model of the wrong system protects the wrong system.