Topic

Threat Modeling

1 post about Threat Modeling. Every summary links to the original.

See the idea

Threat Modeling explainers

Loading Backdoor Defense Is a Trade-off, Not a Scanner image
Trade-offs AI Security Backdoors Safety Security Supply Chain Threat Modeling
Backdoor Defense Is a Trade-off, Not a Scanner
A model that passes benchmarks can still defect only on a trigger. This explainer maps the trade-off between deeper backdoor verification and the friction, latency, and cost it adds.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Red Hat
AI threat modeling shouldn't be a bottleneck, so we open sourced ours
The post announces the open-sourcing of agentic-threat-modeling, an AI-assisted threat-modeling module for Claude Code, Cursor, and Gemini CLI, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). The module ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint. It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet. The team open sourced it because the problem isn’t unique to them, and it’s available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.

The best engineering reads, once a week.

Topic

1 post about Threat Modeling. Every summary links to the original.

See the idea

Loading Backdoor Defense Is a Trade-off, Not a Scanner image
Trade-offs AI Security Backdoors Safety Security Supply Chain Threat Modeling
Backdoor Defense Is a Trade-off, Not a Scanner
A model that passes benchmarks can still defect only on a trigger. This explainer maps the trade-off between deeper backdoor verification and the friction, latency, and cost it adds.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Red Hat
AI threat modeling shouldn't be a bottleneck, so we open sourced ours
The post announces the open-sourcing of agentic-threat-modeling, an AI-assisted threat-modeling module for Claude Code, Cursor, and Gemini CLI, built to address the bottleneck of security teams reviewing AI-generated code. It runs on Lola, an open source package manager for AI contexts, and profiles likely attackers, generates narrative attack scenarios grounded in actual code, and checks them against six structured threat modeling frameworks (STRIDE, PASTA, LINDDUN, attack trees, and more). The module ties every finding to a specific file and line of code, as shown in a real-world example against a file upload endpoint. It’s designed to produce structured output for AI-assisted triage, though that pipeline isn’t built yet. The team open sourced it because the problem isn’t unique to them, and it’s available in RedHatProductSecurity/agentic-threat-modeling and LobsterTrap/lola.

The best engineering reads, once a week.