Long reply here. Executive summary: * Threat modeling execution is becoming agentic. * Human expertise moves upstream to secure architecture. * The primary artifact becomes ARCHITECTURE.md for agents, not a report for humans to read. Long version: I do not say this with malice. Human threat modeling is coming to an end. I say this from experience and from using AI for threat modeling for a few years now and seeing how effective it can be. I like Adam Shostack’s work and his educational offerings. I like threat modeling resources that teach us about secure architecture, things like zero trust, OAuth 2.0-based MCP usage, identity and authorization patterns, and other difficult security architecture choices. I also like solutions that help developers learn about secure architecture so they can prompt properly and make better decisions up front. But the writing is on the wall: I think most threat modeling execution in the future is going to be agentic. And if you hire threat modeling consultants, I think there should be one primary artifact that comes out of the engagement. It’s not a PDF or another report. It’s a living Markdown file: ARCHITECTURE.md. I also don’t want the primary outcome of threat modeling to be a list of problems. What I want, especially as AI development matures, is threat modeling that helps clearly define what the secure architecture should be for that software, including the requirements, assumptions, constraints, and important security decisions. Then agents can continuously reason against that architecture as the software changes. So when I hire threat modeling consultants these days, I want them to be serious software architects who deeply understand security. • Threat modeling execution is becoming agentic. • Human expertise moves upstream to secure architecture. • The primary artifact becomes ARCHITECTURE.md, not a report.

Security open letters: zero commitments, zero accountability, lots of signatures. Would you sign one that actually held you accountable? #TheSecurityTable #CyberSecurity youtube.com/watch?v=E-lSc-f0…