Threat Modeling LLMs: Adam’s talk at Black Hat USA
PHANTOM-B is a practical tool built for threat modeling AI systems
Shostack + Friends Blog
Recent Blog Posts
AI and Business Strategy
How can we shape a business strategy in an ‘AI world?’
Lessons from the OpenAI/HuggingFace AI Security Incident
The big takeaways from the OpenAI incident are over-reliance on benchmarks, anthropomorphization and volume.
Black Hat Talks I'm Excited to Attend This Year (Kymberlee's version)
Kymberlee's list of must-see talks at Black Hat this year
Come think out loud with us: Threat Modeling AI Systems
Kymberlee on the Threat Modeling AI Systems community meetup at Black Hat
The Sessions I'm Genuinely Excited About at Black Hat 2026 (Adam's version)
The things I'm looking forward to at Black Hat this year.
Why PHANTOM-B?
Our newest whitepaper introduces a new threat elicitation tool engineered specifically for LLMs.
What to Expect: Threat Modeling Intensive with Complete AI
Learn what goes into our Threat Modeling Intensive with Complete AI
OWASP Global AppSec EU 2026 Recap (Next up, BlackHat!)
Reflecting on the S+A team's adventures in Vienna and excitement for BlackHat 2026
Appsec roundup - June 2026
From near misses to a new book on the C4 model and fundamental work by NIST showing the limits of today’s AI Guardrails, lots of exciting news about Application security.
The Unanimous Declaration of the Thirteen United States of America
When was the last time you read the Declaration? It remains an amazing document.
The Unkeynote: challenging the Threat Modeling Manifesto in Vienna
It's a trap. (The trap being: can five Threat Modeling Manifesto working group members sit on the ThreatModCon EU Unkeynote stage together and agree on how AI requires them to amend their own work?)
Michael at OWASP: Why interactive learning sticks in cybersecurity
Why are we big fans of using games as a learning tool? Michael makes the case for experience-driven learning.
From the training room: real security starts on the whiteboard
A look at what's happening in the Threat Modeling Intensive session this week in Vienna
Why “The AI Explained It” Isn't Good Enough: Introducing the SCORE Framework
Exploring what it means for an AI to explain itself, and why “it gave a reason” is not the same as accountability.