Threat modeling as a dial, not a switch
Thinking of threat modeling with a knob helps you get more out of it.
Shostack + Friends Blog
Recent Blog Posts
Voting Twice for Secession Would be More Fair
Thinking about secession and mechanisms
The Unanimous Declaration of the Thirteen United States of America
When was the last time you looked over what our country was founded upon?
Appsec Roundup - June 2025
Lots of fascinating threat model-related advances, new risk management tools, games, and more!
Google’s approach to AI Agents -- Threat Model Thursday
What can we learn from Google’s approach to AI Agent Security
Publish your threat model!
We think you should publish your threat model, and we’re publishing our arguments.
The Essence and Beauty of Threat Modeling
Automation sounds great, but what about the essence and beauty?
Appsec Roundup - May 2025
Lots of fascinating threat model-related advances, new risk management tools, games, and more!
Andor: Insider Threats
Andor teaches us about insider threats
Free Threat Modeling Training for Displaced Federal Workers
Free training for displaced government employees
Blackhat Earlybird Prices End Friday
Cyber Hard Problems Report
The Cyber Hard Problems report is coming out
Andor: Think like a leader
Think like a what??!
Andor Threats: Information Disclosure
What Andor can teach us about Information disclosure threats
The Empire’s Threat Modeling
Get one fourth off for May the fourth!