corpus.blog
56,966 blogs · [ { "id": "01a0dd86-a3f2-73b6-8c41-52a097e7c4f5", "title": "Diagrams versus Models (Threat Model Thursday)", "url": "https://shostack.org/blog/diagrams-versus-models/", "published_at": "2026-09-24T00:00:00+00:00" }, { "id": "01a0cf3f-6a8d-72df-bdd9-235f4959501b", "title": "Heading to San Francisco and ready to party for OWASP's 25th", "url": "https://shostack.org/blog/our-plans-for-owasp-and-threatmodcon-26/", "published_at": "2026-09-22T00:00:00+00:00" }, { "id": "01a0cf3f-6a8d-72df-bdd9-235f48b7b4b2", "title": "The Pentagon, China, AI and PHANTOM-B", "url": "https://shostack.org/blog/the-pentagon-china-ai-and-phantom-b/", "published_at": "2026-09-21T00:00:00+00:00" }, { "id": "01a0cf3f-6a8d-72df-bdd9-235f480aec09", "title": "Diagrams and Common Elements (Threat Model Thursday)", "url": "https://shostack.org/blog/diagram-common-elements-threat-model-thursday/", "published_at": "2026-09-17T00:00:00+00:00" }, { "id": "01a0cf3f-6a8d-72df-bdd9-235f47e6f921", "title": "Threat Modeling Intensive with Complete AI: From a Developer's POV", "url": "https://shostack.org/blog/threat-modeling-from-a-software-pov/", "published_at": "2026-09-15T00:00:00+00:00" }, { "id": "01a09545-5549-71e1-a079-91d460d027a6", "title": "Dive into our annual Back to School sale on self-paced training", "url": "https://shostack.org/blog/2026-back-to-school-sale-CBT-training/", "published_at": "2026-09-11T00:00:00+00:00" }, { "id": "01a08ce7-41e2-73e0-b8df-e4f336d8128c", "title": "Diagram Style (Threat Model Thursday)", "url": "https://shostack.org/blog/diagram-style-threat-model-thursday/", "published_at": "2026-09-10T00:00:00+00:00" }, { "id": "01a08ce7-41e2-73e0-b8df-e4f3364327e9", "title": "Save on Threat Modeling 2nd Edition", "url": "https://shostack.org/blog/barnes-and-noble-preorder-sale/", "published_at": "2026-09-09T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a1c223743", "title": "Diagrams and Clarity (Threat Model Thursday)", "url": "https://shostack.org/blog/clarity-in-diagrams-threat-model-thursday/", "published_at": "2026-09-03T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a1b4aa6bd", "title": "Register now for our training at OWASP", "url": "https://shostack.org/blog/registration-for-OWASP-SF-training-is-open/", "published_at": "2026-09-01T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a1a5004b3", "title": "Appsec roundup - July + August 2026", "url": "https://shostack.org/blog/appsec-roundup-july-aug-2026/", "published_at": "2026-08-31T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a19a4710f", "title": "Boundaries, Not Trust Boundaries (Threat Model Thursday)", "url": "https://shostack.org/blog/boundaries-threat-model-thursday/", "published_at": "2026-08-27T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a198e0cdd", "title": "Why threat modeling is the technique that survives AI disruption", "url": "https://shostack.org/blog/threat-modeling-technique-survives-AI-disruption/", "published_at": "2026-08-25T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a198c8fa2", "title": "Threat Modeling: A Second Edition", "url": "https://shostack.org/blog/threat-modeling-2nd-edition/", "published_at": "2026-08-20T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a19042d59", "title": "Threat Modeling LLMs: Adam’s talk at Black Hat USA", "url": "https://shostack.org/blog/phantom-b-talk-summary/", "published_at": "2026-08-04T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a18bf2254", "title": "AI and Business Strategy", "url": "https://shostack.org/blog/ai-and-business-strategy/", "published_at": "2026-07-30T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a18676158", "title": "Lessons from the OpenAI/HuggingFace AI Security Incident", "url": "https://shostack.org/blog/lessons-from-openai-huggingface-ai-security/", "published_at": "2026-07-27T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a1863e691", "title": "Black Hat Talks I'm Excited to Attend This Year (Kymberlee's version)", "url": "https://shostack.org/blog/kymberlee-blackhat-hype/", "published_at": "2026-07-23T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a179e242c", "title": "Come think out loud with us: Threat Modeling AI Systems", "url": "https://shostack.org/blog/ai-bh-meetup/", "published_at": "2026-07-22T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a179b0b7e", "title": "The Sessions I'm Genuinely Excited About at Black Hat 2026 (Adam's version)", "url": "https://shostack.org/blog/blackhat-what-excites-us/", "published_at": "2026-07-20T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a170e4150", "title": "Why PHANTOM-B?", "url": "https://shostack.org/blog/why-phantom-b/", "published_at": "2026-07-16T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a168f1b6e", "title": "What to Expect: Threat Modeling Intensive with Complete AI", "url": "https://shostack.org/blog/what-to-expect-tmiwcai/", "published_at": "2026-07-14T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a15b02b69", "title": "OWASP Global AppSec EU 2026 Recap (Next up, BlackHat!)", "url": "https://shostack.org/blog/owasp-to-blackhat-recap/", "published_at": "2026-07-07T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a1516876c", "title": "Appsec roundup - June 2026", "url": "https://shostack.org/blog/appsec-roundup-june-2026/", "published_at": "2026-07-06T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a14726624", "title": "The Unanimous Declaration of the Thirteen United States of America", "url": "https://shostack.org/blog/the-unanimous-declaration-of-the-thirteen-united-states-of-america-2026/", "published_at": "2026-07-04T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a143a38c2", "title": "The Unkeynote: challenging the Threat Modeling Manifesto in Vienna", "url": "https://shostack.org/blog/unkeynote-in-vienna/", "published_at": "2026-06-26T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a13f65df6", "title": "Michael at OWASP: Why interactive learning sticks in cybersecurity", "url": "https://shostack.org/blog/interactive-learning-owasp/", "published_at": "2026-06-24T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a131535b8", "title": "From the training room: real security starts on the whiteboard", "url": "https://shostack.org/blog/in-the-room/", "published_at": "2026-06-23T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a125a7536", "title": "Why “The AI Explained It” Isn't Good Enough: Introducing the SCORE Framework", "url": "https://shostack.org/blog/ai-explainability-score/", "published_at": "2026-06-17T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a12250f6e", "title": "Summer Plans: Vienna, then Las Vegas", "url": "https://shostack.org/blog/summer-plans/", "published_at": "2026-06-12T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a11da43a3", "title": "Twenty Years of Scaling Threat Modeling", "url": "https://shostack.org/blog/twenty-years-of-scaling-threat-modeling/", "published_at": "2026-06-05T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a1145a007", "title": "Appsec roundup - May 2026", "url": "https://shostack.org/blog/appsec-roundup-may-2026/", "published_at": "2026-06-02T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a105200f1", "title": "UW Cyberday: Threat Modeling in the Age of AI", "url": "https://shostack.org/blog/tm-in-the-age-of-ai-uw/", "published_at": "2026-05-29T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0fd280ea", "title": "Focus on high priority threats(?)", "url": "https://shostack.org/blog/focus-on-high-priority-problems/", "published_at": "2026-05-28T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0ee9eba1", "title": "Vulnerability Finding: Two Inflection Points", "url": "https://shostack.org/blog/vuln-finding-two-inflection-points/", "published_at": "2026-05-26T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0ecc7124", "title": "Remembering Peter Neumann", "url": "https://shostack.org/blog/remembering-peter-neumann/", "published_at": "2026-05-23T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0e08eed5", "title": "PHANTOM-B goes to Black Hat", "url": "https://shostack.org/blog/blackhat-phantom-b/", "published_at": "2026-05-21T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0d3833bc", "title": "HIPAA Updates and Threat Models", "url": "https://shostack.org/blog/hipaa-nprm-threat-modeling/", "published_at": "2026-05-19T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0cb2270e", "title": "Claude Opus 4.7 and Threat Modeling", "url": "https://shostack.org/blog/claude-opus-47-thinking/", "published_at": "2026-05-14T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0c6db9ea", "title": "Black Hat training earlybird pricing ends soon", "url": "https://shostack.org/blog/black-hat-early-bird-26/", "published_at": "2026-05-12T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0c303ebc", "title": "Appsec roundup - April 2026", "url": "https://shostack.org/blog/appsec-roundup-april-2026/", "published_at": "2026-05-06T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0c23bb97", "title": "Clever Clippings Star Wars Art", "url": "https://shostack.org/blog/clever-clippings-star-wars-art/", "published_at": "2026-05-05T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0b8f0f88", "title": "May the Fourth Be With You!", "url": "https://shostack.org/blog/may-the-fourth-be-with-you/", "published_at": "2026-05-04T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0a97288c", "title": "LLM Threat Modeling Is Fun", "url": "https://shostack.org/blog/llm-threat-modeling-is-fun/", "published_at": "2026-04-27T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a09d047c3", "title": "Lessons from Threat Modeling Intensive Using LLMs", "url": "https://shostack.org/blog/lessons-from-owasp/", "published_at": "2026-04-23T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a08ebe7b9", "title": "Measuring the ROI of threat modeling: moving from activity to impact", "url": "https://shostack.org/blog/roi-of-threat-modeling/", "published_at": "2026-04-17T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a08929ee7", "title": "Adam reflects on BSides SF and RSAC", "url": "https://shostack.org/blog/adam-reflections-on-rsac26/", "published_at": "2026-04-14T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0811a344", "title": "Artemis and Cybersecurity", "url": "https://shostack.org/blog/artemis-and-cybersecurity/", "published_at": "2026-04-08T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a08445ab5", "title": "One week left for Threat Modeling AI Systems Early Bird pricing", "url": "https://shostack.org/blog/early-bird-one-week/", "published_at": "2026-04-08T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a07d9b4ea", "title": "DevSecOps: Lessons from the ST:TNG Crew", "url": "https://shostack.org/blog/devsecops-lessons-from-st-tng-crew/", "published_at": "2026-04-05T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a07524729", "title": "DevSecOps: What Every Security Engineer Should Learn from Star Trek", "url": "https://shostack.org/blog/devsecops-learn-from-star-trek/", "published_at": "2026-04-01T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a06f0cadf", "title": "Appsec roundup - March 2026", "url": "https://shostack.org/blog/appsec-roundup-march-2026/", "published_at": "2026-03-31T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0670010e", "title": "Sunshine and Security – Kymberlee’s week at BSides SF and RSAC 2026", "url": "https://shostack.org/blog/kymberlee-reflects-on-bsidessf-and-rsac2026/", "published_at": "2026-03-30T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a05e70baf", "title": "Wasting Failures at RSAC™ 2026 Conference", "url": "https://shostack.org/blog/wasting-failures-rsac-2026/", "published_at": "2026-03-23T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a05aa54ea", "title": "Threat Modeling AI Systems: Finding the Line Between Application Security and AI Security", "url": "https://shostack.org/blog/threat-modeling-ai-systems-course-announce/", "published_at": "2026-03-17T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a0566717c", "title": "Blackhat and Human Factors", "url": "https://shostack.org/blog/blackhat-and-human-factors-2026/", "published_at": "2026-03-16T00:00:00+00:00" }, { "id": "01a087e0-315d-702b-9afa-ca0a04e5fee0", "title": "Silver Hyundais Recalled", "url": "https://shostack.org/blog/silver-car-recall/", "published_at": "2026-03-10T00:00:00+00:00" }, { "id": "01a087e0-315c-71b2-9fc4-40eeee6bb95b", "title": "Appsec roundup - Feb 2026", "url": "https://shostack.org/blog/appsec-roundup-feb-2026/", "published_at": "2026-03-03T00:00:00+00:00" }, { "id": "01a087e0-315c-71b2-9fc4-40eeed8b5881", "title": "Layered Defenses at BSides Seattle", "url": "https://shostack.org/blog/layered-defenses-bsides-seattle-2026/", "published_at": "2026-03-02T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125f28ea3b8", "title": "Welcoming Kymberlee Price to Shostack + Associates", "url": "https://shostack.org/blog/welcoming-kymberlee-price-as-chief-operating-officer/", "published_at": "2026-02-26T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125f1c47bde", "title": "Vulnerability Finding: An Inflection Point", "url": "https://shostack.org/blog/vuln-finding-inflection/", "published_at": "2026-02-18T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125f12a6f63", "title": "The DEF CON 33 Hackers Almanack", "url": "https://shostack.org/blog/hackers-almanack-defcon-33/", "published_at": "2026-02-16T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125f11a4869", "title": "Adam Featured on the AppSec Weekly Podcast", "url": "https://shostack.org/blog/owasp-modern-appsec-podcast/", "published_at": "2026-02-04T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125f1097d75", "title": "Secure By Design roundup - Dec/Jan 2026", "url": "https://shostack.org/blog/appsec-roundup-dec-jan-2026/", "published_at": "2026-01-30T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125f0b394e4", "title": "Threat Modeling in the Age of AI", "url": "https://shostack.org/blog/threat-modeling-in-the-age-of-ai/", "published_at": "2026-01-29T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125efb907f6", "title": "NIST 800-218 revision", "url": "https://shostack.org/blog/NIST-800-218-revision/", "published_at": "2026-01-27T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125ef1e0d71", "title": "Bitlocker, the FBI, and Risk", "url": "https://shostack.org/blog/bitlocker-the-fbi-and-risk/", "published_at": "2026-01-23T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125eeb5e5b5", "title": "Security Advisory SA-26-01 GPS Attacks", "url": "https://shostack.org/blog/security-advisory-26-01-gps-attacks/", "published_at": "2026-01-22T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125edfa4f0a", "title": "Take Control of What you Read, Redux", "url": "https://shostack.org/blog/take-control-of-what-you-read-redux/", "published_at": "2026-01-11T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125ed30794e", "title": "Congratulations to ThreatModeler and IriusRisk!", "url": "https://shostack.org/blog/congratulations-to-threatmodeler/", "published_at": "2026-01-07T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125ec79effb", "title": "A few thoughts closing out 2025", "url": "https://shostack.org/blog/a-few-thoughts-closing-2025/", "published_at": "2025-12-31T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125ebccb189", "title": "Gavle Goat Survived 2025 - or did it?", "url": "https://shostack.org/blog/gavle-goat-survived-in-2025/", "published_at": "2025-12-26T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125ead22ed7", "title": "The Best Holiday Decorations", "url": "https://shostack.org/blog/best-holiday-decorations/", "published_at": "2025-12-18T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125ea2528c5", "title": "OWASP Keynote Available for Viewing!", "url": "https://shostack.org/blog/owasp-keynote-available/", "published_at": "2025-12-17T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125e9b320c8", "title": "State of Threat Modeling 2024-2025", "url": "https://shostack.org/blog/state-of-threat-modeling-2024-2025/", "published_at": "2025-12-12T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125e973e743", "title": "Windows Links and Usable Security", "url": "https://shostack.org/blog/windows-links-and-usable-security/", "published_at": "2025-12-05T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125e8821e29", "title": "Secure By Design roundup - November 2025", "url": "https://shostack.org/blog/appsec-roundup-nov-2025/", "published_at": "2025-11-30T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125e87b556f", "title": "Recent accessibility improvements for the Shostack + Associates website", "url": "https://shostack.org/blog/website-accessibility-improvements-2025/", "published_at": "2025-11-25T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125e7b74746", "title": "OWASP Threat Modeling Reboot", "url": "https://shostack.org/blog/owasp-threat-model-reboot/", "published_at": "2025-11-17T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125e6f3fab3", "title": "Publishing ‘Publish Your Threat Model’", "url": "https://shostack.org/blog/publishing-publish-your-threat-models/", "published_at": "2025-11-12T00:00:00+00:00" }, { "id": "01a087e0-315b-7113-861b-0125e666bd2b", "title": "Secure By Design roundup - October 2025", "url": "https://shostack.org/blog/appsec-roundup-oct-2025/", "published_at": "2025-11-11T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb8d06637f", "title": "Stop Trying to Manage Risk!", "url": "https://shostack.org/blog/stop-trying-to-manage-risk/", "published_at": "2025-11-05T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb8cdcd0e1", "title": "October Adam's New Thing!", "url": "https://shostack.org/blog/oct-ant/", "published_at": "2025-10-31T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb8c6679f0", "title": "The Moonwalkers", "url": "https://shostack.org/blog/the-moonwalkers/", "published_at": "2025-10-30T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb8bde6ecf", "title": "OWASP Board Thoughts 2025", "url": "https://shostack.org/blog/owasp-board-2025/", "published_at": "2025-10-24T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb8b364b97", "title": "LeanAppSec Announcement", "url": "https://shostack.org/blog/lean-app-sec-announcement/", "published_at": "2025-10-22T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb8b13ea76", "title": "Prompt Engineering Requires Evaluation", "url": "https://shostack.org/blog/prompt-enignieering-requires-evaluation/", "published_at": "2025-10-20T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb8a6725af", "title": "AI Insurance Won't Save You", "url": "https://shostack.org/blog/ai-insurance-wont-save-you/", "published_at": "2025-10-08T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb89a50256", "title": "Secure By Design roundup - September 2025", "url": "https://shostack.org/blog/appsec-roundup-sept-2025/", "published_at": "2025-10-01T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb892ac037", "title": "Adam Featured on Inside MedTech Innovation", "url": "https://shostack.org/blog/medtech-innovation-podcast/", "published_at": "2025-09-29T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb887c00da", "title": "Lunar Rover Vehicle, Redux", "url": "https://shostack.org/blog/lunar-rover-vehicle-redux/", "published_at": "2025-09-17T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb8822a12b", "title": "Apollo 15 Lunar Rover Vehicle", "url": "https://shostack.org/blog/apollo-15-lrv-boeing/", "published_at": "2025-09-15T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb8758b15d", "title": "New Adventure! CyberSec Game Challenge 2025", "url": "https://shostack.org/blog/cybersec-game-challenge/", "published_at": "2025-09-12T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb873e735c", "title": "How could LLMs change threat modeling", "url": "https://shostack.org/blog/how-could-llms-change-threat-modeling/", "published_at": "2025-09-09T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb871134c4", "title": "OWASP Training in Washington, D.C.", "url": "https://shostack.org/blog/owasp-dc-announcement/", "published_at": "2025-09-08T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb86a77f0b", "title": "Our back to school sale", "url": "https://shostack.org/blog/back-to-school-sale/", "published_at": "2025-09-05T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb85dcfa75", "title": "Secure By Design roundup - July/Aug 2025", "url": "https://shostack.org/blog/appsec-roundup-july-2025/", "published_at": "2025-08-31T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb85317884", "title": "Mansplaining your threat model, as a service", "url": "https://shostack.org/blog/mansplaining-your-threat-model-as-a-service/", "published_at": "2025-08-26T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb84d9d551", "title": "Threat Modeling Tools", "url": "https://shostack.org/blog/threat-modeling-tools/", "published_at": "2025-08-25T00:00:00+00:00" }, { "id": "01a087e0-315a-7052-85fb-abbb841673e4", "title": "Risk is not a hammer", "url": "https://shostack.org/blog/risk-is-not-a-hammer-usenix-enigma/", "published_at": "2025-08-12T00:00:00+00:00" } ] posts Claim your blog
Back to shostack.org
Blog · corpus.blog/blogs/shostack.org/posts

shostack.org

shostack.org

2026

Diagrams versus Models (Threat Model Thursday)original ↗
24 Sept 2026
Heading to San Francisco and ready to party for OWASP's 25thoriginal ↗
22 Sept 2026
The Pentagon, China, AI and PHANTOM-Boriginal ↗
21 Sept 2026
Diagrams and Common Elements (Threat Model Thursday)original ↗
17 Sept 2026
Threat Modeling Intensive with Complete AI: From a Developer's POVoriginal ↗
15 Sept 2026
Dive into our annual Back to School sale on self-paced trainingoriginal ↗
11 Sept 2026
Diagram Style (Threat Model Thursday)original ↗
10 Sept 2026
Save on Threat Modeling 2nd Editionoriginal ↗
9 Sept 2026
Diagrams and Clarity (Threat Model Thursday)original ↗
3 Sept 2026
Register now for our training at OWASPoriginal ↗
1 Sept 2026
Appsec roundup - July + August 2026original ↗
31 Aug 2026
Boundaries, Not Trust Boundaries (Threat Model Thursday)original ↗
27 Aug 2026
Why threat modeling is the technique that survives AI disruptionoriginal ↗
25 Aug 2026
Threat Modeling: A Second Editionoriginal ↗
20 Aug 2026
Threat Modeling LLMs: Adam’s talk at Black Hat USAoriginal ↗
4 Aug 2026
AI and Business Strategyoriginal ↗
30 Jul 2026
Lessons from the OpenAI/HuggingFace AI Security Incidentoriginal ↗
27 Jul 2026
Black Hat Talks I'm Excited to Attend This Year (Kymberlee's version)original ↗
23 Jul 2026
Come think out loud with us: Threat Modeling AI Systemsoriginal ↗
22 Jul 2026
The Sessions I'm Genuinely Excited About at Black Hat 2026 (Adam's version)original ↗
20 Jul 2026
Why PHANTOM-B?original ↗
16 Jul 2026
What to Expect: Threat Modeling Intensive with Complete AIoriginal ↗
14 Jul 2026
OWASP Global AppSec EU 2026 Recap (Next up, BlackHat!)original ↗
7 Jul 2026
Appsec roundup - June 2026original ↗
6 Jul 2026
The Unanimous Declaration of the Thirteen United States of Americaoriginal ↗
4 Jul 2026
The Unkeynote: challenging the Threat Modeling Manifesto in Viennaoriginal ↗
26 Jun 2026
Michael at OWASP: Why interactive learning sticks in cybersecurityoriginal ↗
24 Jun 2026
From the training room: real security starts on the whiteboardoriginal ↗
23 Jun 2026
Why “The AI Explained It” Isn't Good Enough: Introducing the SCORE Frameworkoriginal ↗
17 Jun 2026
Summer Plans: Vienna, then Las Vegasoriginal ↗
12 Jun 2026
Twenty Years of Scaling Threat Modelingoriginal ↗
5 Jun 2026
Appsec roundup - May 2026original ↗
2 Jun 2026
UW Cyberday: Threat Modeling in the Age of AIoriginal ↗
29 May 2026
Focus on high priority threats(?)original ↗
28 May 2026
Vulnerability Finding: Two Inflection Pointsoriginal ↗
26 May 2026
Remembering Peter Neumannoriginal ↗
23 May 2026
PHANTOM-B goes to Black Hatoriginal ↗
21 May 2026
HIPAA Updates and Threat Modelsoriginal ↗
19 May 2026
Claude Opus 4.7 and Threat Modelingoriginal ↗
14 May 2026
Black Hat training earlybird pricing ends soonoriginal ↗
12 May 2026
Appsec roundup - April 2026original ↗
6 May 2026
Clever Clippings Star Wars Artoriginal ↗
5 May 2026
May the Fourth Be With You!original ↗
4 May 2026
LLM Threat Modeling Is Funoriginal ↗
27 Apr 2026
Lessons from Threat Modeling Intensive Using LLMsoriginal ↗
23 Apr 2026
Measuring the ROI of threat modeling: moving from activity to impactoriginal ↗
17 Apr 2026
Adam reflects on BSides SF and RSACoriginal ↗
14 Apr 2026
Artemis and Cybersecurityoriginal ↗
8 Apr 2026
One week left for Threat Modeling AI Systems Early Bird pricingoriginal ↗
8 Apr 2026
DevSecOps: Lessons from the ST:TNG Creworiginal ↗
5 Apr 2026
DevSecOps: What Every Security Engineer Should Learn from Star Trekoriginal ↗
1 Apr 2026
Appsec roundup - March 2026original ↗
31 Mar 2026
Sunshine and Security – Kymberlee’s week at BSides SF and RSAC 2026original ↗
30 Mar 2026
Wasting Failures at RSAC™ 2026 Conferenceoriginal ↗
23 Mar 2026
Threat Modeling AI Systems: Finding the Line Between Application Security and AI Securityoriginal ↗
17 Mar 2026
Blackhat and Human Factorsoriginal ↗
16 Mar 2026
Silver Hyundais Recalledoriginal ↗
10 Mar 2026
Appsec roundup - Feb 2026original ↗
3 Mar 2026
Layered Defenses at BSides Seattleoriginal ↗
2 Mar 2026
Welcoming Kymberlee Price to Shostack + Associatesoriginal ↗
26 Feb 2026
Vulnerability Finding: An Inflection Pointoriginal ↗
18 Feb 2026
The DEF CON 33 Hackers Almanackoriginal ↗
16 Feb 2026
Adam Featured on the AppSec Weekly Podcastoriginal ↗
4 Feb 2026
Secure By Design roundup - Dec/Jan 2026original ↗
30 Jan 2026
Threat Modeling in the Age of AIoriginal ↗
29 Jan 2026
NIST 800-218 revisionoriginal ↗
27 Jan 2026
Bitlocker, the FBI, and Riskoriginal ↗
23 Jan 2026
Security Advisory SA-26-01 GPS Attacksoriginal ↗
22 Jan 2026
Take Control of What you Read, Reduxoriginal ↗
11 Jan 2026
Congratulations to ThreatModeler and IriusRisk!original ↗
7 Jan 2026

2025

A few thoughts closing out 2025original ↗
31 Dec 2025
Gavle Goat Survived 2025 - or did it?original ↗
26 Dec 2025
The Best Holiday Decorationsoriginal ↗
18 Dec 2025
OWASP Keynote Available for Viewing!original ↗
17 Dec 2025
State of Threat Modeling 2024-2025original ↗
12 Dec 2025
Windows Links and Usable Securityoriginal ↗
5 Dec 2025
Secure By Design roundup - November 2025original ↗
30 Nov 2025
Recent accessibility improvements for the Shostack + Associates websiteoriginal ↗
25 Nov 2025
OWASP Threat Modeling Rebootoriginal ↗
17 Nov 2025
Publishing ‘Publish Your Threat Model’original ↗
12 Nov 2025
Secure By Design roundup - October 2025original ↗
11 Nov 2025
Stop Trying to Manage Risk!original ↗
5 Nov 2025
October Adam's New Thing!original ↗
31 Oct 2025
The Moonwalkersoriginal ↗
30 Oct 2025
OWASP Board Thoughts 2025original ↗
24 Oct 2025
LeanAppSec Announcementoriginal ↗
22 Oct 2025
Prompt Engineering Requires Evaluationoriginal ↗
20 Oct 2025
AI Insurance Won't Save Youoriginal ↗
8 Oct 2025
Secure By Design roundup - September 2025original ↗
1 Oct 2025
Adam Featured on Inside MedTech Innovationoriginal ↗
29 Sept 2025
Lunar Rover Vehicle, Reduxoriginal ↗
17 Sept 2025
Apollo 15 Lunar Rover Vehicleoriginal ↗
15 Sept 2025
New Adventure! CyberSec Game Challenge 2025original ↗
12 Sept 2025
How could LLMs change threat modelingoriginal ↗
9 Sept 2025
OWASP Training in Washington, D.C.original ↗
8 Sept 2025
Our back to school saleoriginal ↗
5 Sept 2025
Secure By Design roundup - July/Aug 2025original ↗
31 Aug 2025
Mansplaining your threat model, as a serviceoriginal ↗
26 Aug 2025
Threat Modeling Toolsoriginal ↗
25 Aug 2025
Risk is not a hammeroriginal ↗
12 Aug 2025
Next