Shostack & Friends Blog

New repudiation threats, fascinating results from rewriting code in rust, a new strategic plan for OWASP, AIs love their own slop, two new books, and more!

This month leads off with economics: James Shore explains that You Need AI...

Slides for today's talk

I’m happy to be speaking today at CyberAI, a Cybersecurity AI Conference at UW Bothell.

My slides are here”

It’s easy to think prioritization is an easy problem, but it’s one deserving careful consideration.

“We need to focus on high priority threats!”

We hear this all the time. In fact, it was practically a refrain at a recent National Academies Forum on Cyber Resilience meeting on

Understanding the numbers from Anthropic and the system that surrounds Glasswing gives us new possibilities for effective defense.

In February, before project Glasswing, I wrote about An Inflection Point in Vulnerability Finding. Friday, Anthropic released a l...

Peter Neumann helped define the field, and my career. He'll be missed terribly.

Peter G. Neumann has passed, and we are all poorer for it. John Markoff wrote his obituary for the New York Times, and Gene Spafford and ...