If you've shipped an AI agent, you've probably hit the moment where someone asks "so what could go wrong?" and the honest answer is a shrug. Agents don't fail like a CRUD app. They have a model that can be steered, tools they can call, memory they accumulate, and an environment they act on — and the failure can start in one place and surface in another. MAESTRO is one attempt to make that question answerable in a structured way. MAESTRO — "Multi-Agent Environment, Security, Threat, Risk, and Outcome" — is a threat-modeling framework for agentic AI published by the Cloud Security Alliance (CSA), authored by Ken Huang of CSA's AI Safety work. It's a method, not a control catalog: it gives you a way to walk an agent system and enumerate what an attacker (or an accident) could do, layer by layer. It builds on familiar threat-modeling traditions — STRIDE, PASTA, LINDDUN and others — and adds the AI-specific concerns those older methods never had to consider, like adversarial inputs to a model or an agent acting autonomously in ways nobody scripted.
The reason a layered approach fits agents is that an agent isn't one thing. A prompt injection lives at the model boundary, a poisoned document lives in data, an over-permissioned tool lives in the framework, and a leaked credential lives in deployment. If you only threat-model "the agent" as a black box, you miss the seams between these pieces — and the seams are where agent attacks actually live.
MAESTRO decomposes an agentic system into seven layers. Six are stacked; one (security and compliance) cuts across all of them.
For each layer you ask the usual threat-modeling questions, but scoped to that layer's concerns, and then you pay special attention to threats that cross layers — an injection at Layer 1 that drives a tool call at Layer 3 that exfiltrates data through Layer 4. CSA has also published a companion Agentic AI Red Teaming Guide that uses this same decomposition to structure hands-on testing. MAESTRO is most useful as the discovery half of your security work. Sit down with your agent's architecture, walk the seven layers, and write down what can go wrong in each — including the cross-layer chains, which are the ones generic checklists miss. The layered structure gives you a way to be systematic instead of relying on whoever in the room happens to remember prompt injection.
What it deliberately does not do is tell you how to fix things. MAESTRO surfaces threats; it doesn't hand you a normative set of controls, and it isn't trying to. So pair it with something that does. Run MAESTRO to build the threat list, then map each threat to a concrete control from a controls framework — input handling, tool-permission scoping, sandboxing, logging, human-in-the-loop gates. The threat model tells you what to worry about; the control framework tells you what to put in the code. Used that way, MAESTRO turns "what could go wrong?" from a shrug into a list you can actually work through.
MAESTRO is one of the sources behind BRACE, an open, vendor-neutral framework for securing autonomous AI agents — where MAESTRO helps you find what can go wrong layer by layer, BRACE names the controls to fix it. It's built by reading the incidents and the research and asking, each time: what concrete control would have prevented or contained this?