Redefining Threat Modeling: Security Team Goes on Vacation
summary
Claims a training-heavy, multi-year program that gets engineers to run 80% self-serve threat models while security focuses on the remaining 20%. Piloted at Segment (trained ~80% of ~150–200 engineers) and struggles to scale unchanged to 2,500 engineers at Twilio, so it uses four phases: training → observation → review → security-optional. Measured wins include fewer pentest/bug-bounty findings and faster patching (team patched a high Node vuln before security woke), and the open-source training slides are available.
AI-written summary · about
chapters (8)
- 0:00Redefining threat modeling
- 1:56Threat modeling basics
- 8:42Scalable threat modeling
- 14:43Self-service threat modeling
- 22:28Training engineers
- 29:18Program challenges
- 33:56Program wins
- 38:57Q&A
related talks
29mRedefining Threat Modeling: Security team goes on vacation
52mLessons From The Threat Modeling Trenches
39mValue driven threat modelling - security by design
39mDevelopment-centric security in a Global enterprise
34mMeasuring End-to-End Security Engineering
45mHow Three Threat Modelers Can Influence an Entire Organization
58mThreat Modeling In And For Your Organization
35mValue Driven Threat Modeling