How TUI scales threat modeling for 100+ teams with Amazon Bedrock

TUI built an AI-powered threat modeling system on Amazon Bedrock and Amazon Bedrock AgentCore so four security engineers can assess more than 100 digital product teams. AWS Architecture Blog's report says each manual session took 4–6 hours and the team finished only 3–4 a month. A 10-week proof of concept with the AWS Generative AI Innovation Center used Claude Sonnet 4.5, and production followed within 30 days, cutting threat modeling time by up to 70%.

This piece covers that backlog, the serverless design in eu-central-1 (Frankfurt), and the standards-selection change from 338 KB to 21 KB. It is for security engineers and product teams who need STRIDE reviews mapped to TUI Technology Standards, P&E-specific standards, and ISO 27001.

01TUI scales threat modeling for 100+ teams: what actually changed

Each session, an engineer reviewed the architecture, named threats with STRIDE, and mapped them to TUI Technology Standards, P&E-specific standards, and ISO 27001 controls. The record went to Confluence with Jira tickets and took 4–6 hours, covering diagrams, standards, research, and documentation. Four security engineers could finish only 3–4 sessions a month for more than 100 digital product teams, so most teams waited weeks. TUI needed this for every new service in airlines, hotels, cruise ships, and local travel experiences, not only the highest-priority projects.

TUI moved that work onto Amazon Bedrock and Anthropic's Claude Sonnet 4.5 for managed access without operating model infrastructure, extended thinking, and integration with AWS services already in the stack. Amazon Bedrock AgentCore runtime hosts the agent in production without provisioning or scaling infrastructure. AgentCore is the platform for building, connecting, and optimizing agents at scale with any framework or model. The system extends AWS Threat Designer with TUI-specific capabilities and runs serverless in eu-central-1 (Frankfurt). A 10-week proof of concept with the AWS Generative AI Innovation Center led to production within 30 days.

02TUI scales threat modeling for 100+ teams: how it works

Users authenticate with Amazon Cognito and use the React front end on AWS Amplify. Requests pass through Amazon API Gateway to AWS Lambda, which orchestrates the LangGraph workflow on Amazon Bedrock AgentCore runtime. The runtime runs the containerized LangGraph agent, allows sessions beyond a typical function timeout, and isolates each session for concurrent threat models. Claude Sonnet 4.5 on Amazon Bedrock does the analysis, with a configurable extended thinking budget. Amazon DynamoDB holds workflow state and supports resume. Amazon S3 stores diagrams, the TUI knowledge base, and a web search cache.

Engineers upload one or more diagrams, for example a high-level view beside a network topology. The workflow converts them to base64, finds components and data flows, loads the relevant standards, generates threats, refines them, and runs gap analysis. The six-step wizard asks for a title, the files, optional context and assumptions, and a reasoning depth matched to complexity. Setup takes about two minutes. The iterations slider runs from None for a quick scan to High for 20 or more components. A Thinking indicator on the Threats node shows Claude applying extended thinking against TUI security standards.

03TUI scales threat modeling for 100+ teams: why it matters

The first approach loaded all 192 TUI security standards, 338 KB, into the model context. It failed immediately. Some documents run more than 20 pages, and together they exceeded the token limit before analysis started. A smaller set still failed a direct instruction to recommend only TUI-approved tools. The model ignored the approved list and suggested generic alternatives. Contradictory material from different standards confused it, so loading the full set into one prompt did not stay on the approved tool list.

TUI pre-generated keywords, component types, STRIDE categories, and a relevance score for each document. At runtime the model reads about 60 KB of metadata and picks the 16 most relevant standards. Context fell from 338 KB to 21 KB, a 94% reduction versus loading every standard. Security guidelines and approved tools are always mandatory. Other documents apply only to certain architectures. Metadata selection was more predictable and easier to debug than retrieval-augmented generation, because some of the 192 standards are mandatory regardless of the query. Retrieval-augmented generation may complement it as the knowledge base grows.

04TUI scales threat modeling for 100+ teams: who is affected

Four security engineers support more than 100 digital product teams in TUI's Platform & Engineering division. Those products cover airlines, hotels, cruise ships, and local travel experiences, and assessments have to keep pace. At 3–4 sessions a month and 4–6 hours each, most teams waited weeks. Expertise was uneven across technology stacks. There was no automated way to confirm TUI Technology Standards, P&E-specific standards, and ISO 27001 controls on every review. TUI required a threat model for every new service.

Submitting engineers use the six-step wizard, about two minutes for a title, diagrams, optional context and assumptions, and a reasoning depth. A kept threat has a title, description, affected component, and threat vector, plus likelihood and impact from TUI's risk matrix. Mitigations name TUI-approved tools and ISO 27001 controls. The workflow can compare its catalog with a subject matter expert assessment, then export PDF, JSON, or Confluence. Those checks still use the 192 TUI standards. Each concurrent team gets its own isolated AgentCore session.

05TUI scales threat modeling for 100+ teams: what to watch

The threats node runs a Reason and Act pattern in a LangGraph subgraph. Four tools are available: add a threat, delete a threat, read the current catalog, and run gap analysis. The agent chooses which tool to call and in what order. It drafts a STRIDE set, then reviews that set against the standards loaded for the architecture. After three threat-generation calls the workflow forces gap analysis, and the agent must assess what is missing before adding more. Extended thinking on Claude Sonnet 4.5 is configurable.

The deployment is in eu-central-1 (Frankfurt). Model availability varies by Region, so Claude Sonnet 4.5 has to be offered before the same stack runs elsewhere. Metadata selection, which cut context by 94%, is the pattern that stayed after the full standards load failed. Retrieval-augmented generation was less predictable where some documents are mandatory on every query, and it may complement metadata selection as the knowledge base grows. After the 10-week proof of concept, production landed within 30 days, with threat modeling time cut by up to 70%.