# ostering.com

> Brett Crawley's blog on threat modelling, application security, AI and agentic
> security, supply chain risk and EU regulation. Brett is the author of Threat
> Modeling Gameplay with EoP (Packt, 2024) and creator of the Elevation of
> Autonomy card deck for threat modelling AI, LLM and agentic systems.

## Cornerstone posts

- [SLSA and Provenance](https://www.ostering.com/slsa-and-provenance/): What build provenance proves about an artefact's origin, what it cannot promise, why reproducible builds are what actually catch tampering, and why no regulation mandates a SLSA level.
- [Threat Modeling MCP](https://www.ostering.com/threat-modeling-mcp/): STRIDE threat model of the Model Context Protocol, the lethal trifecta, and deterministic versus probabilistic controls.
- [Threat Modeling AI Systems: A Complete Playbook for Practitioners](https://www.ostering.com/threat-modeling-ai-systems-a-complete-playbook-for-practitioners/): The Elevation of Autonomy deck and how to run AI threat modelling sessions.
- [Threat Modeling Your Dependencies - Part 1](https://www.ostering.com/threat-modeling-your-dependencies/): The Supply-Chain Trust Score: quantifying dependency risk across an ecosystem.
- [Threat Modeling Your Dependencies - Part 2](https://www.ostering.com/mitigating-third-party-component-risk/): Proactively swapping low-trust components, with risk-adjusted ROI.
- [Your SBOM Data Has Been Gathering Dust - Until Now](https://www.ostering.com/your-sbom-data-has-been-gathering-dust-until-now/): The sbom-graph open-source supply chain risk platform.
- [Get PQC Ready PDQ - Part 1](https://www.ostering.com/get-pqc-ready-pdq/) and [Part 2](https://www.ostering.com/get-pqc-ready-pdq-part-2/): Post-quantum cryptography readiness.
- [Data Protection and Data Privacy - Part 1](https://www.ostering.com/some-thoughts-on-privacy/) and [Part 2](https://www.ostering.com/data-protection-and-data-privacy-part-2-of-2/): Privacy frameworks and harms.

## About

- Book: Threat Modeling Gameplay with EoP (Packt, 2024)
- Newsletter: The Blast Radius (LinkedIn)
- Open source: https://github.com/mimecast/sbom-graph