Shostack + Friends Blog

Threat modeling. So much threat modeling, and so much more, including foreshadowing of new rules from FDA. (27 Apr 2025)

What’s next for the CVE program? (24 Apr 2025)

Big news for LLMs in threat modeling! (02 Apr 2025)

Thinking about Covid, five years on. (11 Mar 2025)

New releases from DEF CON, the UK’s NCSC, some entertaining AI news, and more! (03 Mar 2025)

Adam was on the CyberTuesday podcast (18 Feb 2025)

An exciting month, with new threat modeling tools, cool thoughts on STAMP, bounds checking, ADRs and more! (12 Feb 2025)

Adam speaking at CERIAS weekdly seminar (11 Feb 2025)

Do diagrams leverage the brain in a different way? (27 Jan 2025)

A virtual feast of appsec! (31 Dec 2024)

A virtual feast of appsec! (05 Dec 2024)

In late 2024, people are being offered a choice of features versus security. (02 Nov 2024)

If you say liability three times, it appears! (30 Oct 2024)

Time to vote for OWASP leadership (15 Oct 2024)

If you say threat modeling three times, it appears! (25 Sep 2024)

Secure boot presents questions that should inform the liability conversation (17 Sep 2024)

The most important stories around threat modeling, appsec and secure by design for August, 2024. (02 Sep 2024)

The failure to secure boot keys should be a bigger deal. (22 Aug 2024)

The most important stories around threat modeling, appsec and secure by design for June, 2024. (02 Aug 2024)

The most important stories around threat modeling, appsec and secure by design for June, 2024. (10 Jul 2024)

Adam on the Scale to Zero podcast (12 Jun 2024)

Commemorating William Anders (08 Jun 2024)

The most important stories around threat modeling, appsec and secure by design for May, 2024. (30 May 2024)

A less busy month in appsec, AI, and regulation, but still interesting stories (08 May 2024)

Making an LLM forget is harder than it seems (21 Apr 2024)

A busy month in appsec, AI, and regulation. (29 Mar 2024)

The NVD is in crisis, and so is patch management. It’s time to modernize. (25 Mar 2024)

A busy month in appsec, AI, and regulation. (05 Mar 2024)

Solving hallucinations in legal briefs is playing on easy mode —— and still too hard (23 Feb 2024)

A busy month+ in appsec, AI, and regulation. (29 Jan 2024)

Comments following the Senate’s CSRB hearing (19 Jan 2024)

A great new resource for threat modeling (12 Jan 2024)

2024 is bringing lots of AI, and Liability, too (02 Jan 2024)

A threat modeling conference, lots of government appsec guidance, and some updates from Shostack + Associates (30 Nov 2023)

What can we learn from the C2PA security considerations document? (29 Nov 2023)

What can we learn from Gunnar Peterson’s Threat Model for Thanksgiving? (23 Nov 2023)

Exciting news from the SEC, lots of AI, and lots of threat modeling. (09 Nov 2023)

Principles are lovely, but do they lead us to actionable results? (27 Oct 2023)

September was a big month in appsec for both memory safety and policy (04 Oct 2023)

The FDA has released their new guidance, which will be broadly impactful. (26 Sep 2023)

We can learn a lot from comparing retrospectives (19 Sep 2023)

Lots of interesting work in LLMs (again) (30 Aug 2023)

My latest at Dark Reading draws attention to how Microsoft can fix ransomware tomorrow. (05 Jul 2023)

(16 Jun 2023)

Adam's AppSecPNW 2023 keynote (12 Jun 2023)

Phishing behaviors, as observed in the wild. (07 Jun 2023)

This month runs quite heavy on AI, but the CISA Safe by Design and Default document is going to be important for the next several years. (30 May 2023)

Tarah Wheeler and Adam write in CFR (25 May 2023)

Some inferences from layoffs in responsible AI teams (21 Apr 2023)

Book signings at RSA, big discounts and more! (19 Apr 2023)

Reflecting on the framing of the Threats book (10 Apr 2023)

A few tools, some thoughts on injection, some standards, and some of Adam’s appsec news. (05 Apr 2023)

Searching my feelings as the audiobook of Threats is released. (17 Mar 2023)

This month is all about memory safety, unless you’re a standards group. (27 Feb 2023)

The new IEEE S+P is all about usable security. (09 Feb 2023)

Watermarks show us wierd edges of AI work (03 Feb 2023)

So many interesting articles from AI to an organizatoion of socio-technical harms, fascinating incident reports about Uber and Circle CI and some history of attack trees. (30 Jan 2023)

Adam spoke with Robert Vamosi of The Hacker Mind podcast (27 Jan 2023)

Adam joined Paul Roberts on the Conversing Labs podcast (23 Jan 2023)

The threats book is in the supply chain, inconsistently. (22 Jan 2023)

The live launch party for Threats! (19 Jan 2023)

The serious side of the book (17 Jan 2023)

Threat Modeling is the software version of measure twice, cut once. (12 Jan 2023)

External changes will be driving appsec in 2023. It’s time to frame the decisions in front of you. (05 Jan 2023)

Looking at a threat model for curl, the command line web client. (29 Dec 2022)

A new paper on how fast, cheap and good can combine into something we usually discount. (28 Dec 2022)

Threat Modeling for UX Designers with Adam Shostack on Heidi Trost's podcast (14 Dec 2022)

The OpenAI chatbot is shockingly improved — its capabilities deserve attention. (09 Dec 2022)

Text captured from GPT-3 (09 Dec 2022)

Threats is almost in bookstores (08 Dec 2022)

Interesting reads this month include signals from the administration, a history of appsec by one of the originals, and a longread from Apple about kernel memory design. (30 Nov 2022)

People learning together (11 Nov 2022)

Interesting appsec posts: machine learning, performance, and C4 (30 Sep 2022)

Our next open course is in just a few weeks! (14 Sep 2022)

Our fall course offerings (06 Sep 2022)

So excited to share the cover with you (19 Aug 2022)

A fun podcast with the ITSP team. (02 Aug 2022)

Interesting appsec posts: machine learning, performance, and C4 (30 Jul 2022)

I'm thrilled this how to guide for standing up new investigations is available. (19 Jul 2022)

I'm thrilled the first CSRB report is available. (14 Jul 2022)

Interesting appsec posts: from medical devices to bridges. (28 Jun 2022)

A collection of interesting appsec posts. (12 May 2022)

The FDA has issued draft guidance for pre-market security (08 Apr 2022)

Threat modeling doesn't need to be a slow, heavyweight activity! (15 Dec 2021)

An important webinar by MDIC about the medical device threat modeling playbook is now available! (21 Nov 2021)

Adam is delivering the opening keynote for OWASP Global Appsec 2021 with a 25 year restrospective on the history of appsec and a look into its future. (11 Nov 2021)

New at Darkreading, a post on NIST and threat modeling (23 Sep 2021)

Are you tired of escalations and fights after pen tests find crucial security issues at the last minute? I have a discount code for upcoming threat modeling training that can help! (02 Sep 2021)

Are you tired of escalations and fights after pen tests find crucial security issues at the last minute? I have upcoming threat modeling training that can help! (16 Aug 2021)

Time flies and things change... A look back on the growth of this industry. (09 Aug 2021)

Earlier this week, NIST released a Recommended Minimum Standard for Vendor or Developer Verification of Code. I want to talk about the technical standard overall, the threat modeling component, and the what the standard means now and in the future. (15 Jul 2021)

Arbitrarily powerful software -- applications, operating systems -- is a problem, as is preventing it from running on enterprise systems. (09 Jun 2021)

AppSec Pacific Northwest Conference is a free application security conference that will be held Saturday, June 19th. It is a virtual, online event sponsored by the OWASP chapters of Portland, Vancouver, and Victoria. (14 May 2021)

Expanding on the UK Government's ‘The Uk Code of Practice for Consumer IoT Security’ and how it aligns with Threat Modeling. (22 Apr 2021)

(24 Mar 2021)

Dr. Gary McGraw joins the IriusRisk Technical Advisory Board (26 Jan 2021)

You may have noticed that my end of the year posts are all science focused. Today, a set of resources on the COVID vaccines. (28 Dec 2020)

Speaking up (22 Nov 2020)

Expanding on our distributed class structure. (07 Oct 2020)

I'm happy to announce Shostack + Associate's new, first, corporate white paper! It uses Jenga to explain why threat modeling efforts fail so often. (16 Jun 2020)

The Sonatype 2020 DevSecOps Community Survey is a really interesting report. Most interesting to me is the importance of effective communication, with both tools and human communication in developer happiness. (12 Jun 2020)

There's an interesting new draft, Best Practices for IoT Security: What Does That Even Mean? by Christopher Bellman and Paul C. van Oorschot. (08 Jun 2020)

Phil Bull presents an interesting, generally convincing, argument in 'Why you can ignore reviews of scientific code by commercial software developers', with a couple of exceptions. (26 May 2020)

Most of my time, I'm helping organizations develop the skills and discipline to build security in. We give the best advice available, and I recognize that we're early in developing the science around how to build an SDL that works. (11 May 2020)

How do we replace the in-person whiteboard sessions essential to Threat Modeling when we are distanced and working remotely? (30 Mar 2020)

New training being developed, seeking interest. (26 Mar 2020)

Exploring supply chain threat modeling with Alexa (05 Mar 2020)

At Blackhat this summer, I'll be offering threat modeling training at Blackhat. Last year, these sold out quickly, so don't wait! (02 Mar 2020)

Risk Framework and Machine Learning (27 Feb 2020)

My course, “Repudiation in Depth” is now live on Linkedin Learning. This is the fourth course in my Learning Threat Modeling series. (11 Feb 2020)

Have you considered the idea that “Files are Fraught With Peril” lately? Maybe you should... (23 Jan 2020)

For my first blog post of 2020, I want to look at threat modeling machine learning systems. (02 Jan 2020)

Earlier this year, I helped to organize a workshop at Schloss Dagstuhl on Empirical Evaluation of Secure Development Processes. I think the workshop was a tremendous success. (07 Dec 2019)

Let's talk CAKED, a threat model for managed attribution. (14 Nov 2019)

Recently, I've seen four cybersecurity approaches for medical devices, and we can learn by juxtaposing them. (02 Nov 2019)

“Includes No Dirt” is a threat modeling approach by William Dogherty and Patrick Curry of Omada Health, and I've been meaning to write about it since it came out. (31 Oct 2019)

Just what the title says. (15 Oct 2019)

I'm excited to announce that I'm hitting my STRIDE and Linkedin has released the second course in my in-depth exploration of STRIDE: Tampering. (10 Sep 2019)

I'm excited to be teaming up with Alpha Strike and Limes Security to deliver training in Vienna November 6-8. (15 Aug 2019)

What have we learned and what steps can we take? (30 Jul 2019)

Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework (SSDF) from NIST is open for comment. (11 Jul 2019)

Let’s explore the risks associated with Automated Driving. (08 Jul 2019)

The road to mediocre writing is paved with over-simplification and distraction. (05 Jul 2019)

Exploring threat models as code. (23 Jan 2019)

J.E. Gordon’s Structures, or Why Things Don’t Fall Down is a fascinating and accessible book. Why don’t things fall down? It turns out this is a simple question with some very deep answers. (07 Dec 2018)

[no description provided] (06 Aug 2018)

[no description provided] (06 Aug 2018)

[no description provided] (16 Jul 2018)

[no description provided] (06 Jun 2018)

[no description provided] (31 May 2018)

[no description provided] (25 May 2018)

As we head into RSA, I want to hold the technical TM Thursday post, and talk about how we talk to others in our organizations about particular threat models, and how we frame those conversations. (12 Apr 2018)

[no description provided] (11 Apr 2018)

[no description provided] (10 Apr 2018)

[no description provided] (27 Mar 2018)

[no description provided] (22 Mar 2018)

[no description provided] (20 Mar 2018)

[no description provided] (15 Mar 2018)

[no description provided] (28 Dec 2017)

[no description provided] (27 Dec 2017)

[no description provided] (14 Nov 2017)

[no description provided] (08 Nov 2017)

[no description provided] (05 Nov 2017)

[no description provided] (02 Nov 2017)

[no description provided] (29 Oct 2017)

[no description provided] (23 Oct 2017)

[no description provided] (18 Sep 2017)

Recently, I was talking to a friend who wasn't aware that I'm consulting, and so I wanted to share a bit about my new life, consulting! (07 Sep 2017)

[no description provided] (20 Jul 2017)

[no description provided] (17 Jul 2017)

[no description provided] (10 Jul 2017)

[no description provided] (06 Jul 2017)

[no description provided] (26 Jun 2017)

[no description provided] (01 Jun 2017)

[no description provided] (30 May 2017)

[no description provided] (24 May 2017)

[no description provided] (23 May 2017)

[no description provided] (04 May 2017)

[no description provided] (01 May 2017)

[no description provided] (24 Apr 2017)

[no description provided] (17 Apr 2017)