Shostack + Friends Blog

 

Risk is not a hammer

My Usenix Enigma 2025 talk A screenshot of a thesis statement: People treat risk analysis as a “hammer” which will solve all their cyber problems. (People includes executives, engineers.) Comments: “Risk” is also treated as an unquestionable axiom

My slides for Usenix Enigma. I’m frankly eager to see if I can compress this into 20 minutes, and so let me mention that a longer (and less refined) version was at CERIAS.

Originally published by Adam on 12 Aug 2025
Categories:   security   risk