Talks

Talks

I speak about threat modelling, mostly about making it something the whole team does rather than something the security team does to them. That means card games, frameworks for systems nobody has modelled properly yet, and the uncomfortable gap between what our tools see and what attackers see.

If you run a conference, meetup or podcast and one of these fits, get in touch on LinkedIn. I can adapt any of them to a shorter slot or a hands-on workshop.

Talks I can give

The Unmodelled Attack Surface: Threat Modelling Email Infrastructure Talk, 30 to 45 minutes. For platform engineers, security architects and AppSec practitioners.

Email carries credentials, payment instructions and password resets, and it is the most impersonated channel in enterprise security. Yet the machinery itself (SMTP, MIME, SPF, DKIM, DMARC, the delivery pipeline) has never had a threat taxonomy of its own. STRIDE will surface something; it won’t surface SMTP smuggling, an inherited verdict or a scanner that fails open. This talk introduces a taxonomy of 117 threats across nine layers of the email stack plus eight structural hazards, and shows how to walk it against a real mail flow.

Threat Modelling AI and Agentic Systems with Elevation of Autonomy Talk or workshop, 45 to 90 minutes. For engineers and architects building with LLMs, agents and MCP.

Blocklists and guardrails cover a tiny fraction of the inputs that map to the same model behaviour, and attackers can build cheap surrogate models whose attacks transfer to yours. So model-layer defences give a statistical improvement, not a guarantee. This session explains why, then puts the Elevation of Autonomy card deck in the room: 30 cards across adversarial, autonomy, data and privacy threats plus structural hazards, played against a realistic agentic system. As a workshop, teams leave with a threat model of their own design.

Threat Modeling Gameplay: Making Threat Modelling a Team Sport Workshop, 60 to 120 minutes. For development teams, product managers and anyone new to threat modelling.

Based on my book Threat Modeling Gameplay with EoP (Packt, 2024). Participants learn the Elevation of Privilege card game by playing it against a sample architecture, then extend it with privacy (T.R.I.M.) cards. No security background needed: by the end, everyone in the room has found a real threat and written a mitigation.

AI-Assisted Threat Modelling: Training the Trainers Talk or workshop, 45 to 90 minutes. For security champions, AppSec teams and the people who run threat modelling sessions.

An AI assistant can draft a threat model in minutes. Whether that draft is any good depends on the method behind it and the person reviewing it. This session shows how to pair an AI assistant with a structured method (card decks such as Elevation of Autonomy, and frameworks such as MITRE ATLAS) so it elicits threats rather than inventing them, and how to train the people who facilitate it to challenge what it produces. [Brett: adjust to match the Security Champions Summit talk and the train-the-trainer repo.]

The EU’s New Rulebook for Engineers: CRA, NIS2, DORA and the AI Act Talk, 30 to 45 minutes. For engineering leaders, architects and AppSec teams.

The Cyber Resilience Act’s 24-hour reporting duty is already live, and the AI Act’s transparency obligations apply now even though its high-risk rules moved to 2027. This talk cuts through the legal text to the engineering capabilities all four regimes demand: knowing what you ship, finding what is vulnerable, designing security in and reporting fast. It also shows where the SBOMs these regimes rely on are weaker than they look.

Past talks, webinars and podcasts

Stay tuned for more!