Watch the latest edition
From candid keynotes to hands-on workshop breakouts, catch the highlights from our sold-out Vienna event — and get a taste of what's ahead in San Francisco.
New Here?
ThreatModCon is Threat Modeling Connect (TMC)'s global conference series for security architects and AppSec engineers doing threat modeling. We're intimate by design (under 120 attendees), run by practitioners, focused on real methodology over theory.
What makes this edition special?
The question isn't whether you’re using AI in your threat modeling – it’s how you’re using it.
Almost all sessions in this edition engage the same question from a different angle: does AI-generated threat modeling actually hold up, and what happens when it doesn't? You'll hear the optimistic case, the skeptical case, and a room full of practitioners arguing it out in real time.
Meet our speakers
Every speaker slot is reviewed by an independent Program Committee for one thing: real, usable methodology. No vendor pitches disguised as talks.
Adam is the author of Threat Modeling: Designing for Security, and Threats: What Every Engineer Should Learn from Star Wars, and the first recipient of the Adam Shostack Award for Threat Modeling.
Bill Reid is the Healthcare and Life Sciences Leader in the Office of the CISO at Google Cloud, where he advises healthcare and life sciences organizations. His focus areas include operational resiliency, cyber public health, Operational Technology (OT) security, and applying Artificial Intelligence to advance security and threat modeling practices.
Juliane Reimann is the founder of FullCyrcle Security and a security consultant focused on the human side of cybersecurity. Since 2019, she has worked with large organizations on DevSecOps and security culture, with a particular interest in the intersection of software development and security. Her work centers on building security communities among developers and finding ways to talk about secure software development that actually resonate with engineering teams.
.jpg)
Why it sells out every year
Come see it — feel it for yourself.
Threat modeling as the one focus
We're not a generic security conference. We're a conference for threat modeling. Period.
Practitioner-led integrity
Every session is vetted by a committee of industry experts for actionable methodology.
Built to be worked, not watched
Other conferences often charge extra for hands-on workshops. Not this one — it's included.
Small and engaging by design
We've been asked to double or triple the capacity, but we deliberately keep it under 120 people — the right size to comfortably talk to anyone in the room.
.jpg)
Agenda
Our session agendas include keynote speakers, expert-led topic discussions, networking sessions, happy hours, and more!
Opening Remarks
AI Writes the Model. CRA Demands the Proof. Where Do You Fit?
Session details
AI can draft a threat model in minutes. The EU Cyber Resilience Act (CRA) is raising the bar for what teams have to prove. Somewhere in between are the people doing the work.
In this (un)keynote, Adam Shostack, Bill Reid, and Juliane Reimann bring three perspectives (methodology, regulated industries, and security culture) to the questions practitioners are facing right now. What should never be handed off to AI? What counts as proof when a regulator asks? And what does the threat modeler's role look like from here?
Moderated by James Rabe, the conversation stays grounded in what you can actually do when you're back at work.
Confidently Wrong: Validating AI-Generated Threat Models at Scale
Session details
AI can write you a threat model in minutes. But can you trust it? AI does not look at your system, it only reads what you give it - old diagrams, half-finished PRDs, code from last week. It quietly fills the gaps and hands you a confident, well-written answer that may be part fiction. This talk shows a real example, highlights which findings are true and which are guesses, then turns the real ones into tests that actually get fixed.
Defensible Risk Acceptance
Session details
Every security leader faces this: threat modeling surfaces real risks, but fixes take months you don't have. Most treat it as overhead that gates delivery. Reframe it: position threat modeling as your first decision gate, and security becomes the team enabling faster moves, not saying no.
This briefing shares a framework tested in regulated environments where compliance and velocity matter. Learn to structure threat modeling to accelerate decisions and position security as a business partner!
How We Integrated Threat Modeling into the Agentic Development Lifecycle
Session details
AI agents now write a meaningful share of production code, and they ship at a cadence no quarterly threat modeling workshop can match. When we adopted agentic development internally, our threat modeling program broke: models went stale within a sprint, and every review started from zero because nothing learned from the review before it.
This is a case study of how we rebuilt threat modeling as a continuous workflow inside the agentic development loop, rather than a gate in front of it.
Why do we threat model anyway?
Session details
Threat modeling is one of the most recommended security practices, and one of the most misunderstood. Teams are told to “do a threat model,” then handed a template, a meeting invite, and a vague hope that something useful will come out the other side. The result is often predictable: busywork, generic STRIDE lists, and a document no one reads again.
This talk answers a deceptively simple question: why do we threat model anyway?
Beyond STRIDE: The "Doors, Windows & Holes" Methodology for Threat Modeling Web Apps
Session details
Most practitioners know STRIDE, but still struggle to answer "where do I start?" to create a threat model. STRIDE categorizes threats, but it doesn't tell you how to find them. This session introduces the Doors, Windows & Holes methodology: a technique to surface all entry points (obvious and hidden), paired with a two-bucket mental model (business logic controls vs. source-to-sink traces) to systematically find threats, and their corresponding mitigations. Demonstrated live on a sample web app.
Promises vs. Practice: An Honest Conversation on AI in Threat Modeling
Session details
We are drowning in AI threat modeling promises. Vendors call it a magic bullet for automating risk assessment, but reality often feels like early SAST/DAST: noise, weak context, and heavy cognitive load on teams.
This is not another LLM demo. It is a debate on whether AI is a silver bullet or just a hammer. We will examine structured data, burnout from context switching, and a Security Turing Test to judge whether these tools truly protect assets or just create faster paperwork.
When Your Coworker is an Agent: Threat Modeling Claude Cowork
Session details
Claude Cowork gives AI real capabilities: reading files, browsing with the user's authenticated sessions, running code, executing unattended scheduled tasks, and driving the desktop directly. Each capability breaks an assumption classic threat models rest on. This session presents a complete, evidence-based threat model of an enterprise Cowork deployment, covering prompt injection paths, MCP supply chain, exfiltration channels, and unattended execution, plus a reusable open-source template.
Assessing the Quality of AI generated Threats
Session details
AI is making the generation of threats during threat modeling easier but maintaining quality can be challenging. This session will provide a framework for determining what a quality threat looks like and how that quality might be measured using AI during threat generation.
Who Wore It Better? AI Threat Modeling Edition
Session details
Can you tell whether a threat was identified by a human or generated by AI? And what does that tell us about the role of human vs AI in threat modeling?
In this peer review session, we’ll review a threat model that’s been worked on by AI and humans. With the threats presented side by side, you’ll guess the source, and we’ll look at the threats that fooled us most.
Come test your instincts and find out: Who wore it better?
Threat Modeling: What's Changing & What Comes Next
Session details
Adam Shostack reflects on more than a decade of progress in the discipline: what we've learned, which practices have stood the test of time, and how threat modeling is evolving to meet the realities of modern software development. Drawing from his upcoming second edition of "Threat Modeling: Designing for Security in an AI World," Adam will share effective approaches to threat modeling in an agile world, working with and threat modeling LLMs, boundaries and diagramming, and other shifts shaping the state of the practice. Attendees will leave with a clearer view of how threat modeling has evolved, where the industry is headed, and what practitioners should be thinking about next.
The Adversary Has an Imagination. Does Your Threat Model?
Session details
Threat models are often limited by familiar checklists, recent incidents, and the imagination of the people in the room. This talk introduces SHIELD, a practical method for using strategy, history, and fiction as structured feedstock for better threat modeling.
Closing Keynote & Games
Meet our Sponsors
Frequently Asked Questions
Who is this conference for?
AppSec engineers, security architects, and anyone doing threat modeling as part of their day-to-day work. Sessions assume familiarity with the practice. Beginners are welcome (we're happy to pair you up with someone more seasoned to help you get comfortable!), but come prepared, this isn't a place to ask what the Four Questions are.
What time does this event start and end?
ThreatModCon kicks off at 6PM on Friday, November 6 with the Welcome Reception (directly after the OWASP Global AppSec USA 2026). The conference runs all day on Saturday from 8:00AM to 5:00PM.
Is there a virtual or hybrid option?
No. All ThreatModCon events are in-person only. This edition is no exception. We believe real magic happens when the right people, at the right caliber, share a room.
Will the sessions be recorded?
Not this time. Everything shared stays in the room – live only, no recordings.
What's the format like?
Two tracks, one goal. Brief delivers focused 30-minute presentations. Sandbox is hands-on, featuring workshops, threat model peer reviews, and open forums.
How many tickets are available?
ThreatModCon is small by design (under 120 people) and sells out every year. Grab your spot before it's gone.
Is there any discount available?
Limited early bird tickets ($50 off) are available through mid-October or while supply lasts.
The debate happens November 6-7. Be in the room for it.
With under 120 seats, this event tends to sell out.
.png){kind=logo}
