Threat Modeling AI Systems: Finding the Line Between Application Security and AI Security
Announcing a new course from the Shostack + Associates team.
Shostack + Friends Blog
Recent Blog Posts
Blackhat and Human Factors
BlackHat invites human factors work
Appsec roundup - Feb 2026
This month's roundup starts with losing oneself, continues with cool new threat modeling tools and applications, and continues into appsec, AI and regulation.
Layered Defenses at BSides Seattle
How do we use models to help us answer what are we going to do?
Welcoming Kymberlee Price to Shostack + Associates
We’re pleased to share that Kymberlee Price has joined Shostack + Associates as our Chief Operating Officer.
Vulnerability Finding: An Inflection Point
LLM-driven vuln finding has reached an inflection
The DEF CON 33 Hackers Almanack
The 2026 Hackers Almanack is out!
Adam Featured on the AppSec Weekly Podcast
Learn more about threat modeling and the Four Question Framework
Secure By Design roundup - Dec/Jan 2026
The normalization of deviance, exciting threat modeling news, and a question of do regulatory threats change ‘the threat model’ as much as GPS attacks? Not yet.
Threat Modeling in the Age of AI
Adam will be the featured speaker at the ISC2 Seattle Chapter meeting in February.
NIST 800-218 revision
NIST 800-218 wants you!
Bitlocker, the FBI, and Risk
What can the Bitlocker story tell us about risk?
Security Advisory SA-26-01 GPS Attacks
GPS attacks trigger revisiting threat models
Take Control of What you Read, Redux
In 2026, it’s more important than ever to take control of what you read