VerSprite, a global leader in risk-based threat modeling and the firm behind the PASTA (Process for Attack Simulation and Threat Analysis) methodology, today announced the general availability of Fork, a continuous application threat modeling platform, alongside Knife, an AI-led, human-on-the-loop adversarial testing platform for web applications and web API endpoints. Together, the two products operationalize a new model for product security—one where applications are securely designed, continuously modeled, and actively tested as part of the build process itself.
VerSprite launches Fork (threat modeling) and Knife (adversarial testing) platforms.
Built on PASTA methodology, the only risk-centric, business-aligned threat modeling approach.
Fork enables threat models in under two hours with AI-accelerated attack trees.
Knife provides AI-led, human-on-the-loop adversarial testing for web apps and APIs.
Integrates with SAST, DAST, SCA, vulnerability scanning, and IT service management tools.
Free Fork Community edition available; Enterprise plans include full integrations and testing.
For two decades, application threat modeling has leaned heavily on STRIDE—a categorization mnemonic for spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. STRIDE is useful for sorting threats into buckets, but it was never a methodology. It does not ingest real-time threat intelligence, it does not weigh business impact, and its static categories say nothing about the adversary behaviors defining risk today—persistence, extortion, double-extortion ransomware, supply-chain compromise, and the novel attack surfaces introduced by AI-enabled applications. The result is a familiar bottleneck: threat modeling gets treated as a one-time, document-heavy exercise that lands too late in the lifecycle.
Fork is a practical, software-driven implementation of PASTA—the only risk-centric, business-aligned threat modeling methodology, co-authored by VerSprite founder and CEO Tony UcedaVelez. Rather than categorizing threats in the abstract, PASTA's seven stages move from business objectives through attack surface, application decomposition, threat analysis, weakness and vulnerability analysis, attack modeling, and finally risk and impact analysis. Fork brings that rigor to the cadence of modern development, enabling teams to produce a defensible, risk-prioritized threat model in under two hours. Key capabilities include AI-accelerated attack trees that remove noise and focus on viable, high-impact paths; contextualized, threat-informed models enriched with live cyber threat intelligence; industry-aligned taxonomies including MITRE and OWASP frameworks; a proprietary residual risk formula; and a single pane of glass for unified views.
VerSprite is debuting Knife, an AI-led, human-on-the-loop adversarial platform for web applications and web API endpoints, trained on more than 20 years of accredited offensive security work from VerSprite's BREAKERS OffSec team. Where Fork serves as the blueprint for adversarial testing, Knife executes against that blueprint—pairing the scale and speed of AI with expert human oversight to validate exploitability with real-world fidelity. The integration closes the loop that has long separated threat modeling from testing. From within a Fork threat model, teams can request targeted, on-demand testing of specific weaknesses and attack patterns. Knife runs the assessment; results flow back into the model; and Fork updates the residual risk automatically.
Tony UcedaVelez, CEO and founder of VerSprite and co-author of the PASTA methodology, stated: "The future of product and software security is an integrated model of AI SecOps—where products are securely designed and tested as part of the functional build process, not bolted on afterward. STRIDE gave the industry a vocabulary. PASTA gave it a methodology. Fork and Knife now give it operational speed—continuous threat modeling and integrated, AI-led testing that keeps pace with how software is actually built and how adversaries actually behave."
About VerSprite
VerSprite is a global cybersecurity firm specializing in risk-based threat modeling, offensive security, and managed security services. Founded in 2007 and headquartered in Atlanta, Georgia, VerSprite is the originator of the PASTA (Process for Attack Simulation and Threat Analysis) methodology and partners with Fortune 500 enterprises and product organizations worldwide to reduce cyber risk through a structured, data-driven, adversary-informed approach.
About Fork
Fork is VerSprite's continuous application threat modeling platform. Built on the PASTA methodology and accelerated by AI, Fork enables security, engineering, and product teams to produce risk-centric threat models in under two hours, contextualize them with live threat intelligence and full-stack vulnerability data, and keep them continuously aligned with how applications evolve—now with integrated, AI-led adversarial testing through Knife.
