Mansplaining your threat model, as a service
Everyone wants robots to help with threat models. How’s that working out?
Shostack + Friends Blog
Recent Blog Posts
Threat Modeling Tools
A 2025 view of threat modeling tools
Risk is not a hammer
My Usenix Enigma 2025 talk
LLMs as Compilers
What if we think about LLM coding as if it’s a compiler stage?
Blackhat and Defcon 2025
Adam’s plans for summer camp
Risk Management and Threat Modeling
Threat modeling finds threats; risk management helps us deal with the tricky ones.
The Cyber Resilience Act (CRA)!
The CRA is coming and it's going to be a dramatic change for technology producers
Threat modeling as a dial, not a switch
Thinking of threat modeling with a knob helps you get more out of it.
Voting Twice for Secession Would be More Fair
Thinking about secession and mechanisms
The Unanimous Declaration of the Thirteen United States of America
When was the last time you looked over what our country was founded upon?
Appsec Roundup - June 2025
Lots of fascinating threat model-related advances, new risk management tools, games, and more!
Google’s approach to AI Agents -- Threat Model Thursday
What can we learn from Google’s approach to AI Agent Security
Publish your threat model!
We think you should publish your threat model, and we’re publishing our arguments.
The Essence and Beauty of Threat Modeling
Automation sounds great, but what about the essence and beauty?
Appsec Roundup - May 2025
Lots of fascinating threat model-related advances, new risk management tools, games, and more!