Oh My Hack
An audience that responds to demonstrated attack paths, which makes it a good venue for defensive material framed from the attacker's side.
Updated
Recorded talk (Polish)
The Polish-language version of the Allegro threat modeling talk, delivered at Oh My Hack 2024: scaling STRIDE across many product teams at Allegro, and what makes a threat model produce control changes instead of a risk register.
Angle
Defence explained through the attack path: what an attacker does after the first valid token, and which of your controls would have interrupted it — the same identity-attack-path thinking behind the Conditional Access and PIM work I led at Allegro.
Watch the recording
Related
Confidence
Recorded CONFidence talk: threat modeling at the scale of Allegro, from STRIDE to a process engineering teams actually run.
Identity attack paths
Using BloodHound and Entra ID review to find privilege escalation paths across on-premises Active Directory and cloud identity.
Identity & Zero Trust
Entra ID hardening, Conditional Access authentication strengths, privileged access management and identity attack-path analysis with BloodHound.
Threat modeling
Facilitated STRIDE threat modeling on your real architecture, plus the templates and coaching to keep teams doing it without me.
Threat modeling
A practical STRIDE-based threat modeling method for cloud, application and AI systems, built to be run by engineering teams.
STRIDE for AI systems
Applying STRIDE to LLM and agentic applications: what each category means when untrusted text can act as instructions, where STRIDE stops covering multi-agent failure modes, and the controls per element.