When your security team has four engineers and your organization has over 100 digital product teams, threat modeling becomes a bottleneck fast. TUI operates across the travel and tourism industry with airlines, hotels, cruise ships, and local travel experiences.
What happened
That was the challenge TUI faced. TUI operates across the travel and tourism industry with airlines, hotels, cruise ships, and local travel experiences. Our Platform & Engineering division needs security assessments to keep pace.
Where the sources line up
At TUI, each threat modeling session took 4–6 hours of manual work: reviewing architecture diagrams, mapping threats to internal standards, researching security issues, and documenting findings in Confluence. The team could complete only 3–4 sessions per month, leaving a constant backlog.
Practical impact for readers
TUI needed threat modeling to become mandatory for every new service, not a luxury TUI reserved for the highest-priority projects. TUI built an AI-powered threat modeling system using Amazon Bedrock , collaborating with the AWS Generative AI Innovation Center during a 10-week proof of concept (PoC) to develop and validate the architecture. Amazon Bedrock is a fully managed service for building generative AI applications, and TUI used the Claude Sonnet 4. 5 foundation model from Anthropic. TUI chose Amazon Bedrock for managed access to Claude Sonnet 4. 5 without operating model infrastructure, its extended thinking support that the workflow uses for deeper analysis, and its integration with the AWS services already in TUI’s stack.
Who should pay attention now
In this post, we describe how TUI built an agentic AI workflow for threat modeling, the iteration process that shaped the architecture, and the results after deployment.
What is still unclear
TUI’s security engineering team followed a thorough but manual process: for each application, an engineer reviewed the architecture, identified threats using STRIDE methodology, mapped them to TUI Technology Standards, P&E-specific standards, and ISO 27001 controls, and documented findings in Confluence with Jira tickets.
Latest comments
0No comments yet. You can start the conversation.