Shostack + Friends Blog

Authentication is more frustrating to your customers when you don’t threat model. (04 Jun 2024)

The most important stories around threat modeling, appsec and secure by design for May, 2024. (30 May 2024)

The early bird pricing for my Blackhat training expires this Friday (21 May 2024)

How can we think about non-standard symbols in threat modeling diagrams? (16 May 2024)

A less busy month in appsec, AI, and regulation, but still interesting stories (08 May 2024)

A great threat modeling talk at RSA 2024 (06 May 2024)

(04 May 2024)

What do we need to assess if memory safe langages are 'sufficient'? (29 Apr 2024)

Making an LLM forget is harder than it seems (21 Apr 2024)

(17 Apr 2024)

How we leverage a platform for great training (16 Apr 2024)

The CSRB has released its report into an intrusion at Microsoft, and ... it’s a doozy. (13 Apr 2024)

(01 Apr 2024)

A busy month in appsec, AI, and regulation. (29 Mar 2024)

Join us for a provocative exploration on Thursday! (27 Mar 2024)