Adam Shostack
where else to find them
bluesky:adamshostack.bsky.social
what they talk about
all 4 in the filters
where they keep going back
no series more than once — all 5 in the filters
on a stage with
all 4 in the filters
who talks about the same things
- Brook S.E. Schoenfield6 talks
- Alyssa Miller12 talks
- Izar Tarandach4 talks
- Jonathan Marcil3 talks
- Joshua Corman27 talks
- Jacob West5 talks
| title | conference | date |
|---|---|---|
| Risk Is Not a Hammer, and Most Hazards Aren't Nails | USENIX Security '25 | 2025-08-13 |
Claim: quantifying cyber risk usually fails to guide decisions because necessary iteration and causal links are missing. Evidence: a production auto run fix… | ||
| Keynote: 25 Years in AppSec: Looking Back, Looking Forward | Global AppSec US 2021 Virtual | 2021-11-08 |
Claims 25 years of firsthand AppSec practice including released internal security guidelines (1996) and later work on Microsoft SDL and ship delays show… | ||
| Using Threat Modeling to Improve Compliance | RSAC 2021 | 2021-05-17 |
Claim: mapping PCI line items to explicit threats reveals PCI emphasizes process and management threats (outdated firewall rules, retained auth data, missing… | ||
| The B-MAD Approach to Threat Modeling | Black Hat Asia 2021 | 2021-05-04 |
Argues that the common instruction bring me a diagram creates needless conflict and late-stage fixes by turning a collaborative design step into a blame-driven… | ||
| Reverse Engineering Compliance | Black Hat Asia 2021 | 2021-05-04 |
Applies classic reverse engineering (GDB and assembler dumps from past work) to the PCI DSS v3.2.1 rulebook, mapping its 139 pages of requirements into a… | ||
| Threat Modeling Panel | OWASP AppSec California 2018 | 2018-01-30 |
Panel argues threat modeling succeeds when it’s modular, iterative and owned by the team, not a one-off review. Practical takeaways: use connection flow… | ||
| nothing matches | ||