We Teach Security Backwards: I Put AI Red-Teaming on Day 2 and Never Got There
I designed a two-day workshop with AI red-teaming as a full module, not a closing talk. We finished three of eight sessions. The classics ate both days.
Read articletopic / Threat Modeling
Threat Modeling.
STRIDE, PASTA, OCTAVE, attack trees, kill chains, MAESTRO, the five-zone method. The trade-offs decide which one fits your system. Threat modeling returns more security per hour invested than any other practice; the only frameworks worth learning are the ones that match the architecture you're defending.
Writing under this topic.
10 posts.
Threat Modeling Generative AI: What 11,658 Incidents and the Research Actually Show
Most real-world harm from generative AI does not come from prompt injection. Analysis of 11,658 incidents shows output handling and misinformation dominate.
Read articleWhy STRIDE Breaks When You Threat Model AI Agents
STRIDE was built for deterministic systems. Agentic AI breaks its core assumptions. Here is a five-zone method that actually finds EchoLeak-class attacks.
Read articleBuild Ironclad ML Security Fast: MAESTRO Framework Explained
CSA's MAESTRO framework, explained for practitioners. Layer-by-layer attack surface, control mapping, and how to apply it to your ML pipeline this week.
Read articleWin the AI Security Battle: Essential Moves for Leaders
Five concrete moves security leaders should make this quarter to keep up with AI adoption, without slowing the teams shipping it.
Read articleElevate Cyber Defense: Start Threat Modeling Now
Why threat modeling is the highest-leverage activity in a security program, and how to start without buying tooling or hiring consultants.
Read articleTransform Your Security Strategy with Leading Threat Modeling Tools
A practitioner's comparison of OWASP Threat Dragon, IriusRisk, Microsoft Threat Modeling Tool, and others, with concrete picks by team size and maturity.
Read articleCyber Resilience: Cutting-Edge Threat Modeling Techniques
Beyond STRIDE: attack trees, PASTA, kill chains, and how to combine them into a methodology your engineers will actually use.
Read articleAdvance Your Security: PenTesting's Critical Edge in ISO 27001
Where pentesting fits inside an ISO 27001 program, what auditors look for, and how to scope tests so they produce defensible evidence, not just findings.
Read articleEmpower Your Security: Essential Insights into Threat Modeling
A foundational guide to threat modeling: what it is, when to do it, who should be in the room, and the seven questions every model must answer.
Read article