OWASP Global AppSec EU 2026 Recap (Next up, BlackHat!)
Reflecting on the S+A team's adventures in Vienna and excitement for BlackHat 2026
Shostack + Friends Blog
Recent Blog Posts
Appsec roundup - June 2026
From near misses to a new book on the C4 model and fundamental work by NIST showing the limits of today’s AI Guardrails, lots of exciting news about Application security.
The Unanimous Declaration of the Thirteen United States of America
When was the last time you read the Declaration? It remains an amazing document.
The Unkeynote: challenging the Threat Modeling Manifesto in Vienna
It's a trap. (The trap being: can five Threat Modeling Manifesto working group members sit on the ThreatModCon EU Unkeynote stage together and agree on how AI requires them to amend their own work?)
Michael at OWASP: Why interactive learning sticks in cybersecurity
Why are we big fans of using games as a learning tool? Michael makes the case for experience-driven learning.
From the training room: real security starts on the whiteboard
A look at what's happening in the Threat Modeling Intensive session this week in Vienna
Why “The AI Explained It” Isn't Good Enough: Introducing the SCORE Framework
Exploring what it means for an AI to explain itself, and why “it gave a reason” is not the same as accountability.
Summer Plans: Vienna, then Las Vegas
A roundup of where you'll find us over the next couple of months
Twenty Years of Scaling Threat Modeling
Reflecting on 20 years of work to scale threat modeling
Appsec roundup - May 2026
New repudiation threats, fascinating results from rewriting code in rust, a new strategic plan for OWASP, AIs love their own slop, two new books, and more!
UW Cyberday: Threat Modeling in the Age of AI
Slides for today's talk
Focus on high priority threats(?)
It’s easy to think prioritization is an easy problem, but it’s one deserving careful consideration.
Vulnerability Finding: Two Inflection Points
Understanding the numbers from Anthropic and the system that surrounds Glasswing gives us new possibilities for effective defense.
Remembering Peter Neumann
Peter Neumann helped define the field, and my career. He'll be missed terribly.
PHANTOM-B goes to Black Hat
A busy Black Hat: A new talk, a new practical tool, and a deadline you should know about