Teaching Software Engineers to Threat Model: We Did It, and So Can You
summary
New Relic builds a self‑service threat‑modeling program that trains 100+ engineering teams across ~800–900 services using custom LMS content (Articulate 360), async Slack support and a low‑tech tool choice, anchored to the change‑design document. A pilot with eight teams yields 200 threat models in a year (≈8 threats each), about 400 threats prioritized or fixed, no new headcount, and a three‑quarter rollout by a four‑person security team. STRIDE + Shostack four questions and golden‑path templates drive adoption.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:33Traditional security review problems
- 7:09Secure developer experience need
- 12:45Self-service threat modeling program
- 18:27Threat modeling in development lifecycle
- 24:03Pilot program results
- 29:11Program impact after one year
- 35:16Framework for implementation
- 43:26Q&A on legacy apps and validation
- 48:21Closing remarks
related talks
29mRedefining Threat Modeling: Security team goes on vacation
52mLessons From The Threat Modeling Trenches
58mThreat Modeling In And For Your Organization
01h 00mThreat Modeling for Secure Software Design
45mHow Three Threat Modelers Can Influence an Entire Organization
53mThreat Modeling: uncover vulnerabilities without looking at code
22mEmpowering Developers through Threat Modeling Excellence
57mIntroducing Threat Modelling To Established Teams