Threat Modeling Unleashed

Where is threat modeling headed? In this closing episode, Chris and Trevor explore practical AI use cases, the future of developer-led security, and how organizations can prepare now. Takeaways: The reality of AI today: what’s useful vs. overhyped. Continuous delivery + security: can we really have both? The long-term shift toward “Security by Design” at scale. Positions Devici as a forward-lookin...

Not all tools are created equal. Chris and Trevor compare common approaches — from free tools to heavyweight enterprise platforms — and share guidance on what to look for in the right solution. Takeaways: When Microsoft TMT is enough — and when it’s not. Pros and cons of enterprise platforms like IriusRisk/ThreatModeler. How to measure ROI in terms of risk reduction and developer adoption. Echoes...

Security teams and developers don’t always speak the same language. This episode explores how to make threat modeling a true “team sport” that fits naturally into developer workflows. Takeaways: Collaboration techniques that work. How diagram-first modeling closes the communication gap. Making outputs actionable for developers. Highlights Devici’s real-time collaboration + built-in libraries.

Many threat modeling efforts fall flat. Chris uncovers the common reasons — from cultural pushback to lack of developer adoption — and shares proven strategies for success. Takeaways: The most common pitfalls (and how to avoid them). Embedding consistency across security teams. Scaling without adding headcount. Supports Devici’s “Smarter, simpler threat modeling” positioning.

Threat modeling has evolved from sketches on a whiteboard to AI-enabled, diagram-first platforms. This episode explores how teams can modernize without the complexity of bloated enterprise tools. Takeaways: Why manual and siloed approaches fail at scale. The rise of diagram-driven threat modeling. Where AI fits today — and what’s hype vs. real. Reinforces Devici’s value as simple, intuitive, and f...

Threat modeling can feel overwhelming, but it doesn’t have to be. Chris and Bruce break down who needs to be involved, what roles matter most, and how to start small without losing impact. Takeaways: Key players to engage: architects, AppSec leads, developers, exec sponsors. How to secure buy-in and avoid resistance. Practical first steps to launch a repeatable practice. Aligns with Devici’s “Secu...

Today we are joined by Altaz Valani from Security Compass and Shaun Mckeag, Principal Software Engineer at Gen Digital , to talk about her personal journey in software development and security. Many listeners are either trying to get into secure software development, or have graduated from a program that teaches security and software development, or perhaps recently transitioned from a different r...

Today we are joined by Altaz Valani from Security Compass and Pranshu Bajpai, Security Architect at Motorola Solutions , to talk about the use of application security training to influence developers toward embracing security. Many developers are eager to learn about security but they need help. Developers move very fast because their performance is often measured around release frequency. All of...

Today we are joined by Altaz Valani from Security Compass and Simone Curzi, Principal Consultant at Microsoft , to talk about the role of developers within threat modeling. When we mention threat modeling, what often comes to mind are data flow diagrams created during a security design process. After these diagrams are created and eventually hit the developer backlog, we discover more insights tha...

Today we are joined by Altaz Valani from Security Compass and Jason Keirstead, Distinguished Engineer & Chief Technical Officer of Threat Management at IBM as well as Co-Chair of Open Cybersecurity Alliance. Security tool integrations are largely custom efforts today. That investment alone prevents loose coupling of our security tool architectures and timely delivery of security insights to key de...

Today we are joined by Vaibhav Garg, Executive Director, Cybersecurity & Privacy Research and Public Policy at Comcast , to talk about developer-centric threat modeling. We start by looking at ways to make threat modeling more appealing to developers. We discuss how a security team can help developers participate in threat modeling in the midst of continual change with both development and securit...

Today we are joined by Altaz Valani from Security Compass and Krish Raja, Managing Director at Kroll Cyber Risk division , to talk about developer-centric threat modeling. We will start by discussing how threat modelers can help developers. We then discuss how to define the value of a threat modeling program and common pitfalls when creating such a program. We close off by discussing where threat...

Today we are joined by Simone Curzi, Principal Consultant at Microsoft , to talk about some of the challenges we face today with conducting threat modeling. We will discuss how value creation in threat modeling is tied to the developer community and, ultimately, to the business. Our discussion will then look at how threat modeling must continue to evolve in light of our DevOps delivery cycles. We...

Today we are joined by Spencer Koch, Offensive Security Professional at Reddit, to talk about building a threat modeling practice. We will examine when threat modeling should be done and the associated challenges. We will then turn our attention to the connection between threat modeling and secure coding in the developer space. In conclusion, we will explore some measures of success and where thre...

Today we are once again joined by Kyle Lai, Founder and CISO of KLC Consulting, to talk about CMMC. We will start by discussing the differences between CMMC 1.0 and CMMC 2.0 and discuss the timeline for CMMC 2.0 rulemaking. Our discussion will also look at CMMC 2.0 both from an assessor’s perspective and a Defense contractor’s perspective. Specifically, how an assessor should manage the change if...

Today we are joined by Kim Wuyts from KU Leuven, to talk about privacy threat modeling. We will start by discussing what LINDDUN is and the difference between privacy threat modeling and security threat modeling. We will then discuss how a framework like LINDDUN can be used in DevSecOps pipelines as part of an evolving knowledge base. For those who wish to provide feedback to the LINDDUN team, Kim...

Today we are joined by Nick Deshpande to talk about data governance and security. We will start by introducing the concept of data governance and the business importance of data governance. We will dig deeper and discuss who is responsible for creating and managing a data governance program. When looking at data governance as an enabler, we will turn our attention to three use cases: DevSecOps, Th...

Today we are joined by Kyle Lai, Founder and CISO of KLC Consulting , to talk about CMMC. We will start by discussing the governance and ownership aspects of CMMC. Once a CMMC program has kicked off, teams usually have to overcome some challenges. We will discuss the top challenges with achieving CMMC compliance. In an era of DevSecOps, we will turn our attention to the importance of automation an...

Today we are joined by K Royal, Associate General Counsel & DPO of TrustArc, to talk about Software Development and Privacy. We will start by discussing what the intersection of privacy and software development looks like. We will examine the essential competencies required to produce privacy compliant software and touch on automated privacy checking in the context of DevSecOps pipelines. We will...

Today we are joined by Mark Simos, Lead Cybersecurity Architect at Microsoft , to talk about leveraging security reference architectures to operationalize security. We will talk about our current context and the democratization of security and DevOps across the enterprise. Since security touches so many parts of the organization, this is where the role of security reference architectures becomes c...

Today we are joined by Michael Isbitski, Technical Evangelist at Salt Security , to talk about API Security. Our systems and platforms today are largely driven by API integrations. We will start by discussing ownership of API security in an organization. This will lead into a discussion about convincing a business stakeholder to invest in API security. Given how complex our applications are today,...

Today we are joined by Carmichael Patton, Senior Security Architect at Microsoft , to talk about Zero Trust. We will talk about the value proposition along with ownership and accountability for a Zero Trust program. It is important that Zero Trust aligns with business priorities. We will also discuss the rollout of Zero Trust and some important lessons learned from previous implementations. 

Today we are joined by Rob Akershoek from DXC , to talk about security reference architectures. We will start by discussing why we need a security reference architecture. This will lead us into governance and who is responsible for creating a security reference architecture. Since we don’t have a standard security reference architecture in the industry, we will explain how to start creating a secu...

Today we are joined by Mark Timms, Senior Manager, Cybersecurity Education & Awareness Behavioural Science at RBC , to talk about the human side of cyber security. We will talk about what motivates people to embrace a security program and what triggers drive the intended behavior. Building a security culture takes intentionality and a coordinated set of activities that focuses on the person. We wi...

In this episode, Clay Carter talks about product security in our critical infrastructure- specifically, water! Clay discusses the unique challenges and opportunities of product security in the water industry, the intersection with business partners like safety, importance of domain expertise, and the effect of seeing the products you help secure impact your day to day life.