Appsec roundup - July + August 2026
The CRA, how AI is showing up in security requirements, threat modeling, bug fixing and inventing biases in its spare time. Also, a lot of cool books by other authors.
Shostack + Friends Blog
Posts in category “ai”
Register now for our training at OWASP
Join us in San Francisco for our popular 3-day Threat Modeling Intensive With AI
Why threat modeling is the technique that survives AI disruption
AI is disrupting software security, but traditional threat modeling remains the ultimate survival skill.
AI and Business Strategy
How can we shape a business strategy in an ‘AI world?’
Lessons from the OpenAI/HuggingFace AI Security Incident
The big takeaways from the OpenAI incident are over-reliance on benchmarks, anthropomorphization and volume.
Come think out loud with us: Threat Modeling AI Systems
Kymberlee on the Threat Modeling AI Systems community meetup at Black Hat
Why PHANTOM-B?
Our newest whitepaper introduces a new threat elicitation tool engineered specifically for LLMs.
Appsec roundup - June 2026
From near misses to a new book on the C4 model and fundamental work by NIST showing the limits of today’s AI Guardrails, lots of exciting news about Application security.
Why “The AI Explained It” Isn't Good Enough: Introducing the SCORE Framework
Exploring what it means for an AI to explain itself, and why “it gave a reason” is not the same as accountability.
PHANTOM-B goes to Black Hat
A busy Black Hat: A new talk, a new practical tool, and a deadline you should know about
Claude Opus 4.7 and Threat Modeling
LLMs are great at providing credible answers to questions. And those answers are worth looking at closely.
LLM Threat Modeling Is Fun
Exploring the fun in LLM threat modeling, and how it’s both an interface choice and a possibly ‘dark pattern’
Lessons from Threat Modeling Intensive Using LLMs
Actionable lessons from delivering Threat Modeling Using LLMs, and using AI more generally.
Appsec roundup - March 2026
This month kicks off with Donald Knuth being shocked by LLMs, then goes into the threat modeling impact of right to repair, and how to TM MCP, and a whole lot more!
Appsec roundup - Feb 2026
This month's roundup starts with losing oneself, continues with cool new threat modeling tools and applications, and continues into appsec, AI and regulation.
Secure By Design roundup - Dec/Jan 2026
The normalization of deviance, exciting threat modeling news, and a question of do regulatory threats change ‘the threat model’ as much as GPS attacks? Not yet.
Threat Modeling in the Age of AI
Adam will be the featured speaker at the ISC2 Seattle Chapter meeting in February.
October Adam's New Thing!
Read up on Adam's New Thing from October
Prompt Engineering Requires Evaluation
Understanding ‘prompt engineering’
Mansplaining your threat model, as a service
Everyone wants robots to help with threat models. How’s that working out?
Strategy for threat modeling AI
Clarifying how to threat model AI
Threat Modeling and GenAI with Venkat Ramakrishnan
Podcast episode with Venkat Ramakrishnan discussing the intersection of GenAI and threat modeling
Adventures in LLM Coding
Exploring LLM-driven coding as I get ready for Archimedes
Solving Hallucinations
Solving hallucinations in legal briefs is playing on easy mode —— and still too hard
AI will be the high interest credit card of 2023
I haven’t done a lot of work in Python, and I’ve never used it to produce graphs. But after an hour of pair programming and then using Chatgpt and Github Copilot got me quite far in writing a set of Jupyter Notebooks, and dramatically shrunk the effort to use and debug a new tool. I wanted to record some thoughts on the experience, and what it means for programming and for application security.
Layoffs in Responsible AI Teams
Some inferences from layoffs in responsible AI teams
Five Threat Model Diagrams for Machine Learning
Some diagrams to help clarify machine learning threats
When will Adam be replaced by ChatGPT?
When will Adam Shostack be replaced by ChatGPT
Bing’s ChatGPT
ChatGPT in the headlines again
Threat Model Thursday: BIML Machine Learning Risk Framework
Risk Framework and Machine Learning
Threat Modeling Thursday: Machine Learning
For my first blog post of 2020, I want to look at threat modeling machine learning systems.