"We do threat modeling."
Translation: a PDF nobody's opened since the workshop.
Our founder @kavousian unpacks the fix in Toreon's Threat Modeling Insider: a finding that can't fail a build is one the next pentest gets to find for you.
toreon.com/threat-modelin…
@myselfshubhendu CTM on this table is the one that matters most and gets the least attention. most teams pick a methodology and run it once. the ones that actually work make it continuous, tied to how the architecture changes not how the calendar moves.
This is what we work on at DevArmor!
@SCAuditStudio@aviggiano@monad minimal prompts work when you're hunting known bug patterns. but for design-level flaws (broken access control, missing trust boundaries) the AI needs more context not less. it needs to understand the architecture. the prompt is basically the threat model.
@aviggiano@SCAuditStudio@monad@Fried_rice the threat modeling part is key. without it, AI agents just find the same implementation bugs scanners already catch. the design-level flaws (broken trust boundaries, missing auth paths) need business context that only a threat model provides. thats where the real signal is.
@marcobravoram@LinkedIn the rejected-alternatives section of the ADR is genuinely underrated. most threat models capture what you decided but not what you explicitly said no to.. that's usually where the real security reasoning lives. we think about this a lot at DevArmor.
@Americanfort_io the attack didn't exploit a bug in the code. it exploited a gap in the design. no trust boundaries between what the agent received and what it could execute.. this is why we think threat modeling agents at design time isn't optional anymore.
@AndrewLarson17@Americanfort_io this isnt an input validation failure. it's an architecture failure. the agent's trust model treated every input as instructions with full authority. no amount of input filtering fixes a design where the agent can't distinguish commands from data.
@alver1301@dac_chain "quantum-proof" is a marketing property. not a security property. the right frame is exactly what you said: per-layer threat models with explicit assumptions about what holds today and what needs a migration path. most projects cant answer that honestly yet.
Check out our work!
We are concluding penetration tests on @SpursOfficial trophy cabinet firewall. Good news: threat modeling suggests the assets inside have been air-gapped from the rest of the #EPL since 1961,so data loss risk remains completely negligible
We are concluding penetration tests on @Arsenal trophy cabinet firewall.
Good news: threat modeling suggests the assets inside have been air-gapped from the rest of the #EPL since 2004, so data loss risk remains completely negligible
@D1Olu@Arsenal big congrats to @Arsenal on the title. naturally we pivoted our pentest to @SpursOfficial trophy cabinet firewall.. threat modeling suggests the assets inside have been air-gapped from the #EPL since 1961, so data loss risk remains completely negligible
@avisre@kiransing@just_adev@levelsio@TermiusHQ glad someone said threat modeling and not just 'more tests.' tests validate the code does what you told it to. threat modeling validates you told it the right thing. when AI writes the code that's the part that matters most, and its where we focus @devarmorHQ
@RealJohnnyTime Well said! 'what assumption failed' is the most underrated question in security. controls and signals are implementation fixes. the assumption is the design mistake, and thats where the real money is lost every time.
That's what we're trying to solve at DevArmor.
@studiojin_dev the model dependence part is the real takeaway. rules give you structure but the ceiling is always how much context about the actual system the tool can work with.. curious how it handles business logic and auth flows vs code-level patterns.
We have a blog post about this:
2K Followers 4K FollowingSpeaker | Trainer - AppSec | OSWE | OSCP | CISSP. Tweets or likes are my bookmarks to access those on PC, mobile or in transit. https://t.co/pzKHcVpNhD
1K Followers 5K FollowingSoftware Architect CTO / Founder @RaptorLabsX | AI Security Solutions I AI-native Rapid SaaS I Blockchain Forensics I @anything Expert on @contra I @superteamie
117 Followers 431 FollowingSweet dollar deals from the Steam sale; I play that. No-cam rockin' 2D pic; I stream that. Two and a half men; I weigh that. I'm not a gamer. Check me out!
27K Followers 14K FollowingCoFounder @TopTierAuth. Speaker, AI Advisor, 5x Founder, helping install AI agents for your business operations. Book on my calendar.
1K Followers 5K FollowingSoftware Architect CTO / Founder @RaptorLabsX | AI Security Solutions I AI-native Rapid SaaS I Blockchain Forensics I @anything Expert on @contra I @superteamie
2K Followers 4K FollowingSpeaker | Trainer - AppSec | OSWE | OSCP | CISSP. Tweets or likes are my bookmarks to access those on PC, mobile or in transit. https://t.co/pzKHcVpNhD
38K Followers 260 FollowingWe help secure the world’s most targeted organizations and products. We combine security research with an attacker mentality to reduce risk and fortify code.
5K Followers 275 FollowingOfficial Account of Porsche Digital // Our mission: Digital engineering to spark excitement and to create value // #PorscheDigital
48K Followers 2K FollowingBMC Software unlocks human and machine potential to drive business growth, innovation, and sustainable success. BMC: business faster than humanly possible.
82K Followers 551 Following#AXA Global Twitter account for news & stories about #insurance & asset management, the company & its subsidiaries worldwide
41K Followers 162 FollowingAll trading involves risk. General advice only. AFSL 414530 | SIA-F217 | CMA 128 | FSC GB21026314 | DFSA F004356 | Not intended for a UK or EU audience
399K Followers 14 FollowingTrusted by 50 million investors for over 50 years—helping you invest for your future.
Community guidelines: https://t.co/F9iBO3Q24d
856K Followers 360 FollowingServing as a trusted partner to our clients by responsibly providing financial services that enable growth & economic progress. Customer service: @AskCiti
12K Followers 733 FollowingAll-in-one #payroll, #HR, #benefits & #retirement platform that integrates each aspect of your business. 📥 Send us a DM for 24x7 Support.
76K Followers 824 FollowingSenior reporter at @CyberSecDive covering all things digital security. I also co-host @hothtakes. | Send me tips: https://t.co/XevCjdQhqz
20K Followers 253 FollowingCloud security historian
Developed https://t.co/ZXFwkuyseC, CloudMapper, and Parliament
Organizer for @fwdcloudsec
Researcher at @wiz_io