Skip to main content

Shostack + Friends Blog

Posts in category “reports”

The Obsidia Project Launches

The Obsidia Project is stepping up to document important incidents. (19 Oct 2026)

Our Favorite Content

General threat modeling posts

The Security Principles of Saltzer and Schroeder, illustrated with Star Wars

Other Star Wars blog posts

Modeling attackers and their motives

Doing science with near misses

Posts about “Threat Modeling 2nd Edition”

Posts about Adam’s “Threats” book

Posts about Adam’s “Threat Modeling” book

Posts about “The New School of Information Security” book

About this blog

Popular Blog Topics

Threat Model Thursday,
exploring specific published threat models

Threat Modeling (general topic)

Application Security

Software Engineering

Privacy + Personal Security

Research + Reports

Podcasts, Videos + Webinars

Subscribe (RSS/Mail)

RSS/ATOM: The RSS feed is here. We recommend RSS as the best way to follow this blog, and think generally RSS is the best way to take control of the information you take in. You can read our thinking here.

Email: If you’d like a lower volume set of updates on what Adam is doing, Adam’s New Thing gets only a few messages a year, guaranteed. We include a subset of posts in each.

Recent posts

The Obsidia Project Launches

19 Oct 2026

The Obsidia Project is stepping up to document important incidents.

Defenses: Swiss Cheese (Threat Model Thursday)

15 Oct 2026

A “Swiss cheese model” of defenses helps engineers organize defenses and think broadly.

Part 2: Threat Modeling Intensive with Complete AI From a Developer's POV

13 Oct 2026

Reflecting on AI in the Intensive

Defenses for Developers (Threat Model Thursday)

08 Oct 2026

Defenses are often confusing, and developers make the security choices that are hard to reverse. But if you can handle git, you can handle threat modeling.

Our site works best with Javascript enabled, however we have done our best to minimize any negative impacts to your experience without it.