Secure By Design roundup - Dec/Jan 2026
The normalization of deviance, exciting threat modeling news, and a question of do regulatory threats change ‘the threat model’ as much as GPS attacks? Not yet.
Shostack + Friends Blog
Recent Blog Posts, Page 5
Threat Modeling in the Age of AI
Adam will be the featured speaker at the ISC2 Seattle Chapter meeting in February.
NIST 800-218 revision
NIST 800-218 wants you!
Bitlocker, the FBI, and Risk
What can the Bitlocker story tell us about risk?
Security Advisory SA-26-01 GPS Attacks
GPS attacks trigger revisiting threat models
Take Control of What you Read, Redux
In 2026, it’s more important than ever to take control of what you read
Congratulations to ThreatModeler and IriusRisk!
Congratulations to all involved!
A few thoughts closing out 2025
Prompted by participants, a few closing thoughts for 2025
Gavle Goat Survived 2025 - or did it?
Important news about current events
The Best Holiday Decorations
The best decorations ever
OWASP Keynote Available for Viewing!
Watch Adam's keynote 'Stop Trying to 'Manage Risk'' From OWASP 2025
State of Threat Modeling 2024-2025
The first-ever, community-powered report on threat modeling
Windows Links and Usable Security
Some dialogs can harm the viewer
Secure By Design roundup - November 2025
Perspective on CISOs as facilitators, a deep dive into the types of diagrams for medical devices, poetry, Chinese LLMs, Chinese drones and Chinese routers. Do any of them contain secrets?
Recent accessibility improvements for the Shostack + Associates website
Accessibility is an ongoing process. Learn about some recent updates to the Shostack + Associates website that increase accessibility and usability.