Pecan AI — agentic threat model

Not certain from the listing — Pecan AI leverages 'Predictive GenAI' which likely uses LLMs to generate SQL, data pipelines, or model configurations. This introduces risks of prompt injection leading to unauthorized database queries or misaligned predictive outputs.

Highly critical layer as the platform performs data preparation and model training. Risks include data poisoning of training sets, leakage of sensitive business data during ingestion, and lack of clear lineage/provenance for generated features.

The orchestration framework automates model building and deployment. Insecure tool integration is a key threat, particularly if the agent has write-access to databases or executes unvalidated code during data preparation.

Not certain from the listing — The platform deploys predictive models, which implies hosting infrastructure. If these models are hosted in shared or poorly sandboxed environments, they face threats of container compromise or lateral movement.

Not certain from the listing — While the platform builds and deploys models, the listing does not detail its observability stack. Gaps in drift detection or model performance monitoring could allow silent failures or adversarial manipulation to go unnoticed.

Not certain from the listing — Enterprise data platforms require robust identity, access management, and compliance controls (e.g., SOC2, GDPR). The listing does not specify how user permissions or data access policies are enforced.

Not certain from the listing — There is no indication of multi-agent coordination or marketplace integrations in the provided description, suggesting a single-agent or centralized platform architecture.