4Developers
A developer audience, so the framing is design decisions and pipeline reality rather than security-team process.
Updated
Topics
- Threat modeling that a team can finish in one afternoon — the scoping discipline behind the Allegro-scale STRIDE rollout
- Secure defaults for cloud infrastructure as code
- Shipping AI features without handing over your database
Related
Threat modeling
Facilitated STRIDE threat modeling on your real architecture, plus the templates and coaching to keep teams doing it without me.
Threat modeling
A practical STRIDE-based threat modeling method for cloud, application and AI systems, built to be run by engineering teams.
Terraform
Terraform IaC review: module security, policy-as-code gating, state file protection, dynamic credentials and supply-chain hygiene.
STRIDE for AI systems
Applying STRIDE to LLM and agentic applications: what each category means when untrusted text can act as instructions, where STRIDE stops covering multi-agent failure modes, and the controls per element.
Three layers, three risk profiles
A security review that skips naming its layer — model, service, or agent — ends up testing the wrong attack surface.
Agentic threat models
Why the shift from generative query-response to an autonomous agentic loop changes the threat model of an AI system from bad output to unintended action.