Faced with manually intensive threat modeling and limited security engineering capacity, TUI leveraged Amazon Bedrock and AgentCore to deploy an AI-powered, scalable threat modeling workflow. This innovation reduced review times by up to 70%, enabling mandatory security checks for every new service.
- Reduced threat modeling duration by up to 70% via AI-driven automation
- Deployed agentic workflows on serverless Amazon Bedrock AgentCore runtime
- Ensured consistent application of internal and ISO 27001 security standards
Infrastructure signal
TUI transformed its threat modeling infrastructure by integrating Amazon Bedrock and Amazon Bedrock AgentCore in a serverless architecture, hosted primarily in the AWS eu-central-1 region. This deployment eliminated the need for proprietary model infrastructure provisioning and enabled long-running AI-driven security assessments. Core components include AWS Lambda for orchestration, DynamoDB for state management, and S3 for storing architecture diagrams and knowledge bases.
The platform leverages the Claude Sonnet 4.5 foundation model from Anthropic, accessed through Amazon Bedrock to provide extended reasoning capabilities critical for deeper threat analysis. Amazon Bedrock AgentCore hosts containerized agents to run concurrent sessions with per-session isolation, enabling more scalable, resilient, and maintainable workflows. This architecture allows TUI to automate threat modeling reliably without compromising AWS operational practices or security compliance.
Developer impact
Developers and security engineers benefit from considerably reduced manual workload, as the AI-powered system automates threat identification and standards mapping processes that previously took hours per session. This acceleration shortens feedback cycles, allowing more frequent security reviews mandatory across all new services, thus elevating the overall security posture across 100+ teams.
The system integrates seamlessly with existing developer workflows through a React front end backed by AWS Amplify and Amazon Cognito for authentication. Automated documentation of findings in Confluence with Jira ticket creation helps maintain traceability and follow-up actions without manual intervention. Security engineers can now focus on higher-value activities since routine assessments and standards verification are consistently automated.
What teams should watch
Security, platform, and product teams should monitor the ongoing adoption of AI-assisted threat modeling to understand how it scales with organizational growth and complexity. Observability into AI reasoning and outcome consistency is crucial, requiring tooling to audit automated decisions and ensure alignment with evolving standards like ISO 27001 and internal policies.
Teams should also evaluate integration points—such as API and infrastructure monitoring—to maintain end-to-end security visibility in workflows now partially automated. Additionally, watch for regional model availability and potential impacts on latency or compliance, since Amazon Bedrock model access may vary by AWS region, necessitating region-specific deployment considerations.