What it is
STRIDE was developed at Microsoft in the late 1990s to give engineers a finite checklist of threat categories to walk through during design. The six letters stand for: Spoofing (pretending to be a trusted user or system), Tampering (modifying data or code), Repudiation (denying an action took place because logs are missing), Information disclosure (leaking data to an unauthorized party), Denial of service (making something unavailable), and Elevation of privilege (gaining permissions you should not have). Applied to AI agents, each category gets new attack patterns: spoofing becomes identity spoofing of an agent, tampering becomes memory or training-data poisoning, denial of service becomes resource overload of the agent's queue, and so on.
Why it matters
STRIDE is familiar to most enterprise security teams, which makes it a useful bridge for getting agent risk into the same review process that governs the rest of your stack. If your security team already runs STRIDE on every new application, asking them to apply it to your Agentforce build is a much easier conversation than asking them to learn a new framework. It also forces concrete questions ("what would spoofing look like for this agent?") rather than vague ones ("is this safe?").
Key components
- Spoofing — impersonating a user, system, or another agent
- Tampering — modifying prompts, memory, training data, or tool inputs
- Repudiation — destroying or polluting audit trails
- Information disclosure — leaking data through model outputs or tool calls
- Denial of service — exhausting agent capacity or downstream APIs
- Elevation of privilege — gaining access to tools or data the agent should not reach
How it connects
When building Agentforce agents, STRIDE maps directly to Salesforce's existing security controls — for example, checking elevation-of-privilege risks against your org's permission sets and profiles, or testing information-disclosure risks against how the agent accesses Data Cloud records and external APIs.
Good to know
STRIDE tells you what categories of threat to look for, not how to fix them — so treat it as the starting checklist for a risk conversation with your security team, not a sign-off that the agent is safe to deploy.
Related terms
Resource Overload
A denial-of-service attack on AI agents — flooding them with tasks, prompts, or tool calls until they exhaust compute, API quota, or human review capacity, stalling the workflows that depend on them.
Prompt Injection
An attack where malicious text hidden in data an AI reads hijacks its instructions, making it ignore its real task and do the attacker's bidding.
Threat Modeling (AI Agents)
A structured way to identify what could go wrong with an AI agent before it does — mapping attackers, attack surfaces, and impacts so you can build defenses in.
Privilege Compromise
When an AI agent has been granted broader access than its task actually requires, every other vulnerability becomes more damaging — and the gap is usually a misconfiguration, not an attack.
Identity Spoofing
Attacks where an adversary pretends to be a trusted user, agent, or system in order to issue commands or access data the agent would otherwise refuse.
Repudiation (AI Agents)
When an attacker or a poorly designed agent makes it impossible to reconstruct who did what, when — destroying the audit trail that compliance, incident response, and legal recovery all depend on.
