Our OWASP and ThreatModCon plans, now with dates, times, and one fewer fireside
We promised follow-up details, and here they are: training, talks, a panel, a booth, and the second edition of the book, all in San Francisco in early November.
Last month, in our first sneak peek, we promised follow-up announcements. Here they are, with actual dates, times, and a booth number.
OWASP is holding Global AppSec USA in San Francisco from November 2 to 6. ThreatModCon follows on November 6 and 7. We've got a busy week planned, with several staff members on site.
OWASP: training, a book signing, on stage, and a booth
Before the sessions: Two days of threat modeling training + a day focused on AI
(November 2–4)
We’re delivering Threat Modeling Intensive Using AI at OWASP. The three-day course covers how to threat model, and how to pair those skills with a range of AI systems, including where they help and where they need a second look.
Seats are still available. If you’re in town for OWASP, or you’re a Bay Area engineer who wants to build the skill, this is a good fit. It also works well as a team course, since a shared vocabulary makes the work easier once you’re back at your desks. For a developer’s view of the course, our software engineer Kris describes what it's like to take a Threat Modeling Intensive enhanced with AI content in part 1 and part 2 of her reflections. Register for the training before the AI takes all the good seats.
Book Signing
(Thursday, November 5, 12:15 PM, Grand Ballroom Foyer - Street Level)
Adam will be signing copies of Threats: What Every Engineer Should Learn From Star Wars, the first edition of Threat Modeling: Designing for Security, and The New School of Information Security.
Panel discussion - Plotting your growth in the Age of AI
(Thursday, November 5, 1:15 PM, Grand Ballroom B - Street Level)
Adam joins Daniel Miessler, Chris Wysopal, Chenxi Wang, and Jeremiah Grossman in Plotting Your Growth in the Age of AI, is a practical look at how people should plan their own development as AI changes the work.
CRA Will Be Cloud-Scale Engineering Change
(Friday, November 6, 10:30 AM)
On the main stage, Adam presents CRA Will Be Cloud-Scale Engineering Change. If you want to sell products in Europe, the EU’s Cyber Resilience Act will change how you engineer and document them. If you’ve been treating it as something for the legal department to sort out, this talk may convince you otherwise.
Visit us at booth G8
(Thursday and Friday during Expo Hall hours)
If you’d rather talk face to face, Shostack + Associates staff will be at booth G8 in the OWASP expo hall. Stop by to ask about training, threat modeling, the book, or just to catch up. You’ll be able to find us without having to follow the sound of someone explaining European regulation changes.
ThreatModCon: the unkeynote, a talk, and the hallway track
Adam has two sessions on Saturday. When they're not at a talk, the rest of the Shostack + Associates staff will be enjoying the hallway track (in Kymberlee's case, more likely the Embarcadero Plaza track if the sun's out). Register for ThreatModCon.
Unkeynote panel: AI Writes the Model. CRA Demands the Proof. Where Do You Fit?
(Saturday, November 7, 9:15 AM, Waterfront CDE room)
AI can draft a threat model in minutes, while the CRA is raising the bar for what teams have to prove. Adam joins Bill Reid and Juliane Reimann, with James Rabe moderating. They bring three perspectives (methodology, regulated industries, and security culture) to some practical questions. What should never be handed off to AI? What counts as proof when a regulator asks? And what does the threat modeler’s role look like from here?
Threat Modeling: What’s Changing & What Comes Next
(Saturday, November 7, 3:20 PM , Waterfront CDE room)
You may have heard about a fireside chat. It has become a proper talk, which also settles any questions about hotel permits. Adam reflects on more than a decade of progress in the discipline: what has held up, and how threat modeling is evolving for modern software development. He draws on the upcoming second edition of Threat Modeling: Designing for Security in an AI World, covering threat modeling in an agile world, working with and threat modeling LLMs, boundaries and diagramming, and other shifts in the state of the practice. You’ll leave with a clearer view of where the field is headed and what to focus on next.
Speaking of the book, the second edition arrives in February, and you can preorder it now.
Come say hello
Whether it’s the booth, a session, or the hallway in between, we’d like to hear what you’re working on and what questions you’re bringing home from the week.
Seats in the training are still open, so register today.
Image by midjourney: A watercolor painting of a bright, airy conference hall with tall windows and warm light. In the foreground, a small group of people chat beside a simple exhibitor booth with a lime green banner. In the background, a small panel of presenters sit on a small stage in front of a seated audience. Pale warm cream walls and floor, indigo purple on the people, carpet, and shadows, bright orange and red-orange on chairs and stage lights, lime green accents. Impressionist colorism, watercolor style, clean lines. Warm, welcoming mood, plenty of negative space.