Travel and hospitality / Integrated travel services
TUI: Threat modeling from digital service architecture diagrams against internal security standards
- Company
- TUI
- Country
- Multiple countries
- Adoption stage
- In operation
- Source published
- Date basis
- The date the source was published. It can differ from the date adoption started.
- How the source was checked
- Read the full source text
The work problem
Four TUI security engineers supported more than 100 digital product teams. Reviewing diagrams, identifying threats, mapping them to internal standards and documenting an assessment took 4 to 6 hours. Capacity of only 3 to 4 sessions a month created a backlog and made consistent assessment of every new service difficult.
Technology and data
Engineers upload diagrams and context. A LangGraph workflow running on AgentCore uses Claude Sonnet 4.5 through Amazon Bedrock to read components and data flows. Instead of loading every security standard, it selects relevant standards through document metadata, generates STRIDE threats, checks gaps and refines the results. Each result includes mitigations using internally approved tools and mapped controls. When an expert assessment is supplied, rating differences are highlighted for human review.
Results
TUI reports internal pre- and post-deployment measurements showing up to 70% less work per assessment and monthly capacity rising from 3 to 4 sessions to 10 to 12. As of October 2026, it reports 255 registered users, 86 threat models and 43 active creators. Teams can request assessments themselves and review evidence and recommendations rather than remaining in the previous review queue.
Limits and open questions
Time reductions and adoption are TUI-reported operational metrics. The source provides neither reduction in actual security incidents nor threat-detection false-positive rates. Automatic Jira ticket creation and integration with pre-deployment checks remain planned.
Sources
- How TUI scales threat modeling for 100+ teams with Amazon BedrockAWS / TUI, Accessed
Compiled from public sources. These are not results from ATF Works customers.