Introducing Threat Modelling To Established Teams
summary
Begins with a failed launch: threat modeling as indulgence produces excitement but no fixes, then discovers a concrete list of Jira defects that wouldn’t exist if we’d modeled them, recruits a product manager to lock roadmap time, pilots a “Goldilocks” cohort that actually ships mitigations, and saves struggling groups with facilitated working sessions. Emphasizes time-box sessions and little-and-often scope, warns that raw ticket counts are misleading, and treats improved documentation and cross-team knowledge as measurable wins.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:53Defining threat modeling
- 6:41Initial failure to launch
- 13:53Finding the right approach
- 20:40Implementing guardrails
- 24:14COVID-19 and process reboots
- 28:46Customizing for culture
- 32:04Lessons in consistency
- 34:51Measuring success
- 40:05Strategies for longevity
related talks
52mLessons From The Threat Modeling Trenches
49mThreat Modeling Panel
29mRedefining Threat Modeling: Security team goes on vacation
38mIterative Threat Modelling: Security in Agile Development
01h 00mThe One Where We Threat Model During Development
48mTeaching Software Engineers to Threat Model: We Did It, and So Can You
25mThe B-MAD Approach to Threat Modeling
39mValue driven threat modelling - security by design