Adam Shostack
Shostack turns threat modeling into a design habit: identify what is valuable, who may act against it, and how design choices can reduce risk before software ships.
Adam Shostack is a security practitioner, author, and educator focused on threat modeling. His work includes product security, consulting, and efforts to make adversarial thinking usable during normal engineering design.
Threat modeling for builders
His book Threat Modeling: Designing for Security explains a structured way to consider assets, attackers, mitigations, and validation. The aim is to find design risk early, where changes are generally more effective.
Tools and community work
Shostack helped create CVE, worked on Microsoft SDL threat-modeling tools, and has served in Black Hat and OWASP roles. His work bridges formal security concepts with decisions made by product teams.
Timeline
- 1999Helps create CVE and later serves on its advisory board.
- 2000sWorks on Microsoft security and SDL threat-modeling tools.
- 2014Publishes <em>Threat Modeling: Designing for Security</em>.
- 2016Establishes Shostack + Associates.
Adam Shostack
- Type
- Person
- Era
- 1990s-Present
- Known for
- Threat Modeling: Designing for Security; Microsoft SDL threat-modeling tool; OWASP Threat Modeling project
- Tags
- threat-modeling, application-security, microsoft-sdl, owasp, author
Created by Joas A Santos · Something wrong or want it removed? Open an issue.