Shostack & Friends Blog

Slides for today's talk

I’m happy to be speaking today at CyberAI, a Cybersecurity AI Conference at UW Bothell.

My slides are here”

It’s easy to think prioritization is an easy problem, but it’s one deserving careful consideration.

“We need to focus on high priority threats!”

We hear this all the time. In fact, it was practically a refrain at a recent National Academies Forum on Cyber Resilience meeting on

Understanding the numbers from Anthropic and the system that surrounds Glasswing gives us new possibilities for effective defense.

In February, before project Glasswing, I wrote about An Inflection Point in Vulnerability Finding. Friday, Anthropic released a l...

Peter Neumann helped define the field, and my career. He'll be missed terribly.

Peter G. Neumann has passed, and we are all poorer for it. John Markoff wrote his obituary for the New York Times, and Gene Spafford and ...

A busy Black Hat: A new talk, a new practical tool, and a deadline you should know about Black Hat is shaping up to be a busy one for anyone working at the intersection of threat modeling and LLMs. That includes Shostack + Associates. The Talk: Threat Modeling LLMs: The PHANTOM-B Model

This one has been a long time in the making. If you've been following the work here...