Shostack + Friends Blog

A busy month+ in appsec, AI, and regulation. (29 Jan 2024)

Red Teaming by Bryce Hoffman is a thought-provoking read. (21 Jan 2024)

Comments following the Senate’s CSRB hearing (19 Jan 2024)

A great new resource for threat modeling (12 Jan 2024)

Adam on Red Queen Dynamics podcast (05 Jan 2024)

2024 is bringing lots of AI, and Liability, too (02 Jan 2024)

Yet again, attackers surprise us (29 Dec 2023)

Art is transient (27 Dec 2023)

As 2023 draws to a close, take control of what you read. (26 Dec 2023)

(no description available) (15 Dec 2023)

(12 Dec 2023)

A threat modeling conference, lots of government appsec guidance, and some updates from Shostack + Associates (30 Nov 2023)

What can we learn from the C2PA security considerations document? (29 Nov 2023)

What can we learn from Gunnar Peterson’s Threat Model for Thanksgiving? (23 Nov 2023)

Exciting news from the SEC, lots of AI, and lots of threat modeling. (09 Nov 2023)