If by party, you mean obsess over European bureaucracy, train people in the ways of the Force.. umm, threat modeling, and talk about the book until our voices give out.

Reflections from a Developer

What makes a diagram good or useful?

Diagrams serve needs, and surprisingly, form follows function

AI is disrupting software security, but traditional threat modeling remains the ultimate survival skill.

PHANTOM-B is a practical tool built for threat modeling AI systems

PHANTOM-B is a practical tool built for threat modeling AI systems

The big takeaways from the OpenAI incident are over-reliance on benchmarks, anthropomorphization and volume.

Kymberlee's list of must-see talks at Black Hat this year

Kymberlee on the Threat Modeling AI Systems community meetup at Black Hat

Black Hat USA 2026

Reflecting on the S+A team's adventures in Vienna and excitement for BlackHat 2026

It's a trap. (The trap being: can five Threat Modeling Manifesto working group members sit on the ThreatModCon EU Unkeynote stage together and agree on how AI requires them to amend their own work?)

Why are we big fans of using games as a learning tool? Michael makes the case for experience-driven learning.

Exploring what it means for an AI to explain itself, and why “it gave a reason” is not the same as accountability.

It’s easy to think prioritization is an easy problem, but it’s one deserving careful consideration.

Understanding the numbers from Anthropic and the system that surrounds Glasswing gives us new possibilities for effective defense.

A busy Black Hat: A new talk, a new practical tool, and a deadline you should know about

HIPAA reform seems to lead to published threat models, and that’s going to be a hard change.

LLMs are great at providing credible answers to questions. And those answers are worth looking at closely.

All about the upcoming Threat Modeling Intensive with Complete AI at Black Hat and why you should be the early bird

Structured, systematic and comprehensive security comes when your team has trained in a standard approach for threat modeling.

The importance of slow time in work is a theme for April, along with how Claude optimized away its own security rules. Also fun games collected at RSA!

Celebrating Star Wars Day with a look at what Darth Maul’s training can teach you.

Actionable lessons from delivering Threat Modeling with AI, and using AI more generally.

Shostack + Associates COO Kymberlee Price shares her experience measuring the impact of secure design engineering practices on security outcomes

This link will take you to a page that’s not on LinkedIn

Adam finally caught his breath and sat down to reflect on BSides SF and RSAC 2026.

Security, privacy, economics & unrelated topics, since 2005.

Security engineers in a DevSecOps world can learn a few things from Star Trek.

Cybersecurity should learn lessons from industries that are transparent about failure.

Learn to identify, evaluate, and mitigate AI‑specific threats in this 2‑day, in‑person intensive training. Build skills in threat modeling for ML, generative AI, RAG systems, and AI agents using a…

Contact information for Shostack + Associates

It's become a standard practice for organizations to disclose the bare minimum about a data breach, or worse — not disclose the incident at all.