Grab the slide deck for @adamshostack.bsky.social's Black Hat USA talk introducing the PHANTOM-B model, now available on the Shostack + Friends blog. The talk starts at Wednesday at 11:05am in Oceanside C, Level 2. shostack.org/blog/phantom...

Threat Modeling LLMs: Adam’s talk at Black Hat USA

PHANTOM-B is a practical tool built for threat modeling AI systems

shostack.org

Three lessons from the OpenAI/HuggingFace incident: volume overwhelms judgment, anthropomorphization distorts analysis, and stealing benchmark answers is Goodhart's Law made literal. Adam's new post, with pointers to other useful takes on the incident:

Lessons from the OpenAI/HuggingFace AI Security Incident

The big takeaways from the OpenAI incident are over-reliance on benchmarks, anthropomorphization and volume.

shostack.org

Kymberlee's Black Hat 2026 must-see list is up: adversarial scarves, agentic trust boundaries, developer compromise blast radius, risks of security scanners in the supply chain, and a community conversation on threat modeling AI systems.

Black Hat Talks I'm Excited to Attend This Year (Kymberlee's version)

Kymberlee's list of must-see talks at Black Hat this year

shostack.org

Threat modeling LLMs & AI pipelines is hard, and no single org has all the answers. Come trade notes, failures, and open questions at our Black Hat community meetup Thu, Aug 6 @ 12 PM | The Convergence (Business Hall) | Any hall pass gets you in! Read more:

Come think out loud with us: Threat Modeling AI Systems

Kymberlee on the Threat Modeling AI Systems community meetup at Black Hat

shostack.org

Seats are filling up for our Threat Modeling Intensive w/ Complete AI at Black Hat! Learn the fundamentals + when/how to use LLMs in threat modeling Apply it live in a hackathon-style exercise with personalized feedback from Adam + team. Regular pricing ends Friday. blackhat.com/us-26/traini...

PHANTOM-B whitepaper is out today. A STRIDE analog for LLMs built for teams shipping under real constraints, not writing PhD theses. Read it, then catch Adam at Black Hat. Click through for the whitepaper+talk+our training, all must-sees for folks building AI systems. shostack.org/blog/why-pha...

AI is changing threat modeling, but fundamentals still matter most. Join @adamshostack.bsky.social's 4-day Threat Modeling Intensive with Complete AI at Black Hat USA 2026 (Aug 1-4, Las Vegas). Regular pricing ends July 17. 🔗 shorturl.at/CmBtW Read more: shorturl.at/aPqVP #ThreatModeling

Black Hat USA 2026

Black Hat USA 2026

shorturl.at

👻 Adam Shostack's PHANTOM-B white paper drops this week. Unlike OWASP's LLM Top 10, PHANTOM-B is a threat elicitation tool, built to answer "what can go wrong in this system," not just list known failures. He's also speaking on it at Black Hat. Catch both 😉 #LLMSecurity #ThreatModeling

The S+A team had a blast in Vienna at OWASP Global AppSec EU 2026! From leading our Threat Modeling Intensive to meeting fellow AppSec folks, thanks to everyone who showed up, dove deep, and learned by doing. Reflections on the training here: shostack.org/blog/owasp-t...

OWASP Global AppSec EU 2026 Recap (Next up, BlackHat!)

Reflecting on the S+A team's adventures in Vienna and excitement for BlackHat 2026

shostack.org

Tomorrow at ThreatModCon EU: five Threat Modeling Manifesto working group members challenge their own work in public. Does it still hold in the age of AI? 9am CEST, Vienna. Adam's on the panel before his talk later in the day. We’ve also got a booth, so drop by!

The Unkeynote: challenging the Threat Modeling Manifesto in Vienna

It's a trap. (The trap being: can five Threat Modeling Manifesto working group members sit on the ThreatModCon EU Unkeynote stage together and agree on how AI requires them to amend their own work?)

shostack.org

Security is a decision-making discipline. Michael Novack of Cranium is back on the Shostack + Friends blog to explain why interactive learning builds better instincts than passive training and what that looks like in practice.

Michael at OWASP: Why interactive learning sticks in cybersecurity

Why are we big fans of using games as a learning tool? Michael makes the case for experience-driven learning.

shostack.org

Michael Novack of Cranium AI is putting the friend in the Shostack + Friends blog with a post on why "the AI explained it" isn't good enough and what a real explainability standard looks like. It's a great read ahead of his OWASP Vienna talk on June 25.

Shostack + Friends Blog > Why “The AI Explained It” Isn't Good Enough: Introducing the SCORE Framework

Exploring what it means for an AI to explain itself, and why “it gave a reason” is not the same as accountability.

shostack.org

"Focus on high priority threats" sounds obvious. I'm not sure it is. New post on why unstructured prioritization is its own kind of risk, and what to do about it. shostack.org/blog/focus-o...

Shostack + Friends Blog > Focus on high priority threats(?)

It’s easy to think prioritization is an easy problem, but it’s one deserving careful consideration.

shostack.org

Anthropic dropped a lot of Glasswing numbers. Adam made a Sankey diagram and it raised some questions. The interesting part isn't the find rate. It's the 1,006 unpatched vulns, the gap between finding and fixing, and the impact on humans.

Shostack + Friends Blog > Vulnerability Finding: Two Inflection Points

Understanding the numbers from Anthropic and the system that surrounds Glasswing gives us new possibilities for effective defense.

shostack.org

Excited to announce that Adam is presenting Threat Modeling LLMs: The PHANTOM-B Model at Black Hat, a practical threat modeling tool for real deployment timelines. Also, early bird pricing for our Black Hat training course ends tomorrow. Details:

Shostack + Friends Blog > PHANTOM-B goes to Black Hat

A busy Black Hat: A new talk, a new practical tool, and a deadline you should know about

shostack.org

There are changes coming to HIPAA security rules and I have some thoughts on what that will mean for organizations. shostack.org/blog/hipaa-n...

Shostack + Friends Blog > HIPAA Updates and Threat Models

HIPAA reform seems to lead to published threat models, and that’s going to be a hard change.

shostack.org

Some thoughts about evaluating chatbot-driven threat modeling. shostack.org/blog/claude-...

Shostack + Friends Blog > Claude Opus 4.7 and Threat Modeling

LLMs are great at providing credible answers to questions. And those answers are worth looking at closely.

shostack.org

New on the blog: a reminder about Threat Modeling Intensive with Complete AI, our four-day course at Black Hat, and the end of early bird pricing next Friday. Adam walks through the course in a video on the post.

Shostack + Friends Blog > Black Hat training earlybird pricing ends soon

All about the upcoming Threat Modeling Intensive with Complete AI at Black Hat and why you should be the early bird

shostack.org

It's Friday, a good day to check "register for that course" off your list before the weekend and we have some exciting options! The new Threat Modeling AI Systems in DC starts May 19. Early pricing for our Intensive with Complete AI at BlackHat ends May 22. Links to courses at shostack.org/training

Training from Shostack + Associates

Structured, systematic and comprehensive security comes when your team has trained in a standard approach for threat modeling.

shostack.org

April Appsec roundup: slow time, AI agents, Claude bypassing its own rules, and faster-but-not-better patch cycles. Plus, Adam is presenting "Threat Modeling in the Age of AI" at VanSecSIG tomorrow and links to upcoming training.

Shostack + Friends Blog > Appsec roundup - April 2026

The importance of slow time in work is a theme for April, along with how Claude optimized away its own security rules. Also fun games collected at RSA!

shostack.org

Not a model to follow is Darth Maul's training. Different is ours. Our code maythe4th you must use for one-fourth off self-paced courses. shostack.org/blog/may-the...

Shostack + Friends Blog > May the Fourth Be With You!

Celebrating Star Wars Day with a look at what Darth Maul’s training can teach you.

shostack.org

Adam is excited to join the Vancouver Security Special Interest Group (VanSecSig)/ ISC2 Vancouver Chapter on May 8th 2pm to 4pm PT for a talk: “Threat Modeling in the Age of AI". Registration is available through VanSecSig. us06web.zoom.us/meeting/regi...

This week, we’ve got a new blog post about how we use AI in our work and what we’ve learned in our AI-focused courses. We’ve also got two courses coming up: Threat Modeling AI Systems in DC next month, and a Complete AI edition at Black Hat.

Shostack + Friends Blog > Lessons from Threat Modeling Intensive With AI

Actionable lessons from delivering Threat Modeling with AI, and using AI more generally.

shostack.org

Kymberlee Price uses her experience with secure design engineering practices to suggest ways to measure the ROI of threat modeling that track impact, not just activity, in our latest blog post . shostack.org/blog/roi-of-...

Shostack + Friends Blog > Measuring the ROI of threat modeling: moving from activity to impact

Shostack + Associates COO Kymberlee Price shares her experience measuring the impact of secure design engineering practices on security outcomes

shostack.org

Early bird price extended on our exciting new course, Threat Modeling AI Systems, delivered by Shoshana Cox and Michael Novack on May 19 + 20 in Washington, D.C. The price is active until the end of the day today, April 16, anywhere on Earth. Claim your spot: courses.shostack.org/courses/Thre...

Adam went to San Francisco for BSides SF and RSAC and immediately jumped into some projects after getting back (did you know we have upcoming open courses?). He's finally had the chance to post his reflections on the conferences. shostack.org/blog/adam-re...

Shostack + Friends Blog > Adam reflects on BSides SF and RSAC

Adam finally caught his breath and sat down to reflect on BSides SF and RSAC 2026.

shostack.org

There's one week left to take advantage of early bird pricing for our newest course, Threat Modeling AI Systems, taking place in-person on May 19-20 in Washington DC. Register by April 15 at courses.shostack.org/courses/Thre...

First Contact Day falls on a Sunday this year. We did not plan that but we did plan the second post in our Star Trek series. Come meet the crew with us. Picard. Worf. Troi. Data. It turns out the Enterprise senior staff has a lot to teach security engineers. Check back Sunday at shostack.org/blog!

Shostack + Friends Blog

Security, privacy, economics & unrelated topics, since 2005.

shostack.org

See what Star Trek can teach security engineers. Kymberlee Price sets a course in today's Shostack + Friends blog post. Live long and threat model.

Shostack + Friends Blog > DevSecOps: What Every Security Engineer Should Learn from Star Trek

Security engineers in a DevSecOps world can learn a few things from Star Trek.

shostack.org

We're very excited to transport into our new branding today. Let us know what you think of our new look! shostack.org