A warm welcome to the Software Safety Institute
A significant new voice for software safety has joined the field, and Adam is proud to lend his support.
Shostack + Friends Blog
Recent Blog Posts
SF talks: CRA changes + the state of threat modeling in 2026
Adam is speaking at both OWASP and ThreatModCon this week. Download the slides here.
Appsec roundup - September/October 2026
New threat model tools, a PHP bug, chain-of-thought isn’t, and ... we’re not playing games here, or are we?
Our OWASP and ThreatModCon plans, now with dates, times, and one fewer fireside
We promised follow-up details, and here they are: training, talks, a panel, a booth, and the second edition of the book, all in San Francisco in early November.
The Obsidia Project Launches
The Obsidia Project is stepping up to document important incidents.
Defenses: Swiss Cheese (Threat Model Thursday)
A “Swiss cheese model” of defenses helps engineers organize defenses and think broadly.
Part 2: Threat Modeling Intensive with Complete AI From a Developer's POV
Reflecting on AI in the Intensive
Defenses for Developers (Threat Model Thursday)
Defenses are often confusing, and developers make the security choices that are hard to reverse. But if you can handle git, you can handle threat modeling.
Threats and LLMs (Threat Model Thursday)
There are many ways to ask what can go wrong, and the useful skill is knowing which one matches what you're building.
Diagrams versus Models (Threat Model Thursday)
What does the new book tell us about the difference between diagrams and models?
Heading to San Francisco and ready to party for OWASP's 25th
If by party, you mean obsess over European bureaucracy, train people in the ways of the Force.. umm, threat modeling, and talk about the book until our voices give out.
The Pentagon, China, AI and PHANTOM-B
Could PHANTOM-B have stopped this close call?
Diagrams and Common Elements (Threat Model Thursday)
All diagrams should have common elements, and using them consistently is a mark of skill and maturity
Threat Modeling Intensive with Complete AI: From a Developer's POV
Reflections from a Developer
Dive into our annual Back to School sale on self-paced training
Upgrade your engineering skills this fall with 20% off our self-paced Threat Modeling courses.