Learning security is one thing. Applying it is another.
Organizations invest heavily in improving security. Yet many still struggle to turn that investment into consistent security practice and better security decisions.
Training helps teams build a shared language, develop practical skills, and create a foundation for stronger security decisions.
Our courses are designed to help security professionals, developers, architects, and leaders move from understanding security concepts to applying them in real-world environments.
Threat modeling is the measure twice, cut once of cybersecurity. Structured techniques help you understand the danger so you can create a focused defensive security strategy.
In today’s fast-paced world with its rapidly evolving threat landscape, threat modeling gives you a way to find security bugs early and understand your security requirements so you can engineer better products that you deliver on time.
Why us?
We offer the best threat modeling training available.
Our founder is one of the leading experts in threat modeling and security engineering. Our training is laser-focused on threat modeling as the heart of security engineering work. We've trained thousands of people with methods that deliver results.
We know training works best when people have a chance to develop specific technical skills, to apply them, and to reflect on how they and others have applied them. We design our training on specific learning goals, including skills (technical and soft), values (the importance of security) and understanding (shifting left reduces rework). To meet your needs, we have instruction and logistics options, including a choice between live instruction or self-paced/computer-based training.
Explore AI Training
AI is changing how software is built, deployed, and attacked. The threat modeling skills that worked for deterministic systems still matter — but they need to be extended, not replaced. At the same time, LLMs have the potential to enhance threat modeling practices.
These courses are designed to do exactly that: give practitioners the knowledge and hands-on experience to threat model AI systems, use AI to do threat modeling work, and build organizational capability that holds up as the technology continues to evolve. The right course depends on where your team is starting from.
If your practitioners are new to threat modeling or want to build a strong foundation before applying it to AI, start with Threat Modeling Intensive using LLMs. It covers the full Threat Modeling Intensive curriculum and extends it into LLMs.
If your practitioners already threat model and need to apply that knowledge to AI systems specifically, Threat Modeling AI Systems is the right course. It assumes threat modeling fluency and goes deep on AI-specific threats, defenses, and the conversations you need to have with data science teams.
Both courses are practical, principles-based, and built for practitioners who are shipping real systems.
How do I choose?
People want training that suits their needs. To meet those needs, we’ve created variants of our courses. To help you think about what will work for you, we have a flowchart. The dashed orange line illustrates one possible set of choices.
Our approach
Hands on, practical, applied exercises where learners threat model in a safe, supported way is the core of our approach.
We believe that training works best when people have a chance to develop specific technical skills, to apply them, and to reflect on how they and others have applied them. We focus our training on specific learning goals, including skills (technical and soft), values (the importance of security) and understanding (shifting left reduces rework). Learners develop both specific technical skills, such as ‘draw a Data Flow Diagram,’ and the ability to discuss them in context, such as ‘compare between DFDs and swim lanes for this project.’
All of our courses are aligned with the Four Question Framework, created by Adam Shostack and widely adopted:
Our 200 level courses go into much more depth in answering the Four Questions, and we start to consider additional ways to answer each. Our 200-level courses are generally one to two days when delivered in-person. At this level (and above) our training engages learners through discussion, hands-on exercises, group work, and often, live feedback from instructors.
300 level
Our 300 level courses focus on additional skills. Reflectivity and comparisons become increasingly important.
We regularly collaborate with instructional designers to help us develop, deliver and maintain great educational content.
Course delivery options
In 2020, we made the shift from in-person to distributed delivery. We invested heavily in instructional design and production, and our customers tell us they’re very happy with the learning experience. We learned about the real learning and logistical advantages of distributed courses. Those advantages include better integration into a workday, travel-free participation for distributed teams, and each learner’s ability to take their time with exercises.
When you want live instruction training for only a few people, our open courses are a great way to go. This can be getting new hires to align with a team, it can be dipping your toe in before making a larger investment, or maybe you’re at a smaller organization. Our open courses are a mix of distributed and in-person. For a list of current open course options, please see the table at the top of this page.
Instruction options
Live instruction
In-person or distributed
Fixed meetings times, pace
Instructor + peer learning
Open or private
Computer-Based Training
Distributed only
Learn at your own time, pace
Peer, instructor interaction on Slack
Price advantage
Live instruction logistics options
In-Person delivery
Learn over 1-3 days
Different attention levels
Travel requirements
Distributed delivery
Learn over a week
Flexible homework time
No travel
Open courses
Open to anyone
No NDA
Committed calendar
Individual seats (no minimum)
Private courses
One customer
NDA
Negotiated calendar
Minimum seats
Course catalog
100 level
Our 100 level courses are all delivered via computer based training, and include:
In partnership with Linkedin Learning, Adam has an ever-growing collection of courses at Adam Shostack's Instructor Page at Linkedin Learning. (These are only sold by Linkedin, so we don't have course numbers.) The most current list is always there, but currently the courses are:
Threat Modeling Intensive (222, two days) We also have industry-specific versions of this course available, including medical device maker focused-versions and others in development.
