AAISM Domain 2 Practice Test 2026 – Complete Exam Prep Guide

In threat modeling, some approaches give you a predefined set of threats, while others use a flexible risk-based structure that centers on attacker goals and the assets being protected. Trike fits the latter. It uses threat trees and a risk-based framework to define security requirements and controls based on attacker objectives and the system’s assets, rather than enumerating a fixed catalog of AI-specific threats. That means it doesn’t bake in AI threats like data poisoning, model inversion, or membership inference as explicit items. Instead, you map those concerns to general vulnerabilities and applicable controls, which is what the description is getting at when it says it lacks AI-specific threat specificity.

This flexibility is especially beneficial for iterative AI development. As the model, data pipelines, and deployment context evolve across cycles, you can continually update the threat tree and the associated risk assessments, refining requirements and controls without being constrained by a static list of AI threats. In contrast, other methods tend to rely on fixed threat categories or processes that don’t adapt as readily to the rapid changes inherent in AI projects, making them less naturally suited to iterative AI workflows.