TL;DR: Most of today’s supply chain compromises start in the software factory, the machinery that turns source code into running software, and there is still no threat taxonomy that covers it end to end. I have published one: 221 threats across 17 stations of the factory, from the developer’s laptop…
Mapping the Software Factory Threat Taxonomy to STRIDE,...
TL;DR In The Unmodeled Attack Surface I made...
51 Card and Board Games for Security, Privacy...
The Threat Model Was Never the Point: What...
This is what some of you have been...
Why $249 Billion Can’t Fix Software Security TL;DR:...
Why a Single KMS Key on a Multi-Tenant...
CRA, NIS2 and DORA for Engineers: You Can’t...
The Case of the Toppled Plant Pot and...
Your Tools See Repositories. Attackers See an Estate....
The Blast Radius runs on one conviction: prefer...
Threat Modeling the Model Context Protocol: Your Agent...
From Principle to Practice: Privacy in the Real...
Untangling the Confusion People often confuse these two...
The Plan, the Order, and the Bill In...
Quantum, AI, and the Window That’s Already Closing...
