From the training room: real security starts on the whiteboard
A look at what's happening in the Threat Modeling Intensive session this week in Vienna
What does a Shostack + Associates Threat Modeling Intensive course actually look like? Our learning model brings practitioners with real problems, real systems, and real organizational complexity into the room, where we work through it together. Together, because none of us are smarter than all of us.
Today was the first day of the open Threat Modeling Intensive course at OWASP Global AppSec in Vienna. The whiteboards are filling up. If you didn't get a spot, here's a sneak peek at what the participants are doing.
Day one starts with practitioners bringing real systems and organizational complexity with them. At the heart of our training is the proposition that participants' real-world questions drive the curriculum to create a hands-on focus on threat modeling and actual engineering.
Design is Not a Polish
Security isn't a final layer of paint you slap onto a finished product. It's a foundational design requirement and we ground it in the Four Question Framework.
We spend the morning on the whiteboards dissecting system architectures to find structural flaws before a single line of code is written. This is what it actually means to shift left. By anticipating design flaws early, we map out data flows, question our own logic, and catch systemic vulnerabilities at the blueprint stage.
What often emerges is a hard truth: outsourcing threat modeling to isolated security teams creates misaligned incentives. The people who build the product need to own the risk because they are accountable for software quality. Security teams enable, but product teams must own the outcomes.
Practical Skills: Learning to Hack the Design
To build something secure, you have to understand exactly how it gets broken. Breakout groups tackle real organizational constraints, discovering actionable engineering principles:
- Exploiting flaws: We actively trace how design oversights create open doors for exploitation.
- Secure by Default: More secure settings shouldn't be opt-in. Customers should have to take intentional, deliberate steps to choose a less secure configuration.
- Smart Mitigations: A single compensating control can often address multiple threats at once.
Tomorrow, and beyond
The energy in Vienna is fantastic. We love a completely sold-out room bursting with brilliant practitioners + game-changing insights and we can't wait for tomorrow! If you missed out or are ready to take your skills to the next level, we're running our Threat Modeling Intensive with Complete AI this August at BlackHat USA as an expanded, four-day course. In additon to the Intensive, it will cover both how to leverage LLMs for threat modeling and how to secure your systems against threats to LLMs themselves. Secure your spot now and let's design more resilient systems from day one!
Image by midjourney: A wide-angle shot of a collaborative training space, whiteboards covered in data flow diagrams, diverse tech professionals in active collaborative discussion at a training course, bright natural lighting that evokes Vienna.