AGL's AI agent drafts security review documents for architects
In plain words
Because security reviews were slowing projects, AGL built an agent that applies threat-modelling frameworks to generate security review documentation that architects then refine.
What happened: Architects start from an AI draft instead of a blank page; deployed in the security architecture team.
Source: istart.com.au ↗
How to do it yourself
Our suggested steps. The company didn't publish theirs.
- 1
Write a one-page template for your security review (system, data, threats, controls, risks).
- 2
Create a Claude Project and upload the template plus your security policy.
- 3
For each new tool or feature, paste its description and run the prompt below.
- 4
A technical person reviews and edits the draft before sign-off.
- 5
Keep all reviews in one folder so the agent can reuse past decisions.
The instructions to give the AI
Paste this into ChatGPT (the free plan is fine), swap the [brackets] for your details, and test it on a few real examples.
Agent instructions (prompt)
Act as a security architect. Using STRIDE, review this system for [business]: [describe system, data, users, integrations]. Output: 1) data flow summary, 2) threats per STRIDE category with likelihood/impact, 3) recommended controls, 4) residual risks, 5) questions for the builder. Follow this template: [paste].
[Highlighted] = replace with your own details before you run it.
What you should get back: A threat table: data flows, risks by STRIDE category, and the top 5 fixes ranked by effort.
Written by Quickly and Good, inspired by this case.
More detail: tools, prices and what you'll need
The company used: Custom agent (threat-modelling frameworks)
You could use: Claude (Project) or ChatGPT + a STRIDE threat-model template
- ChatGPT
General AI assistant: writes, summarises and answers from files you give it.
Free plan; paid plans available · Official site ↗
- Claude
AI assistant for writing, analysis and long documents; can connect to your tools.
Free plan; Pro $20/mo (monthly) · Official site ↗
Prices from each tool's own pricing page, checked Oct 2026.
What you'll need
- ☐A ChatGPT or Claude account
- ☐Your own documents, templates or examples
- ☐The agent instructions (prompt)
- ☐A habit of checking every output before you use it
Can I do this myself?
Yes. You can try this today with a chat assistant and your own files.
Similar cases
ShipStation's Slack IT agent answers 97.5% of staff questions
Replied to 97.5% of messages, handled 812 of 1,221 conversations without a ticket (about 1,600 hours a year saved), and positive ratings rose from 82% to 96%.
Sophos cut security investigation time from 38 minutes to 89 seconds
Average response time on agent-handled cases fell from about 38 minutes to 89 seconds, and 52% of cases are resolved end to end by AI.
Telstra's AI agent checks who has access to what, around the clock
Constant automatic checks replace occasional manual reviews.