Threat Modeling Unleashed

Security teams and developers don’t always speak the same language. This episode explores how to make threat modeling a true “team sport” that fits naturally into developer workflows. Takeaways: Collaboration techniques that work. How diagram-first modeling closes the communication gap. Making outputs actionable for developers. Highlights Devici’s real-time collaboration + built-in libraries.

Threat modeling has evolved from sketches on a whiteboard to AI-enabled, diagram-first platforms. This episode explores how teams can modernize without the complexity of bloated enterprise tools. Takeaways: Why manual and siloed approaches fail at scale. The rise of diagram-driven threat modeling. Where AI fits today — and what’s hype vs. real. Reinforces Devici’s value as simple, intuitive, and forward-looking.

Today we are joined by Altaz Valani from Security Compass and Shaun Mckeag, Principal Software Engineer at Gen Digital, to talk about her personal journey in software development and security. Many listeners are either trying to get into secure software development, or have graduated from a program that teaches security and software development, or perhaps recently transitioned from a different role. It’s nice to have someone with years of experience in the field to give some perspective, guidance, tips, and encouragement. Listen in as Shaun shares her personal journey that will inspire and help those of us who are newer to the secure software space. Useful links from this podcast: https://www.linkedin.com/in/shaunmckeag/ https://nakedsecurity.sophos.com/podcast/ https://www.sans.org/blog/ https://www.devseccon.com/the-secure-developer-podcast https://darknetdiaries.com/ https://owasp.org/events/#AppSec%20Days https://devcon.org/ https://www.blackhat.com/

Today we are joined by Altaz Valani from Security Compass and Simone Curzi, Principal Consultant at Microsoft, to talk about the role of developers within threat modeling. When we mention threat modeling, what often comes to mind are data flow diagrams created during a security design process. After these diagrams are created and eventually hit the developer backlog, we discover more insights that further evolve the security design. In this way, developers are crucial to an evolving threat model activity. Yet, many questions exist. We try to answer some of those developer questions related to threat modeling. Useful links from this podcast: https://simoneonsecurity.com/ https://threatsmanager.com/ https://www.threatmodelingmanifesto.org/ https://cve.mitre.org/ https://cwe.mitre.org/

Today we are joined by Vaibhav Garg, Executive Director, Cybersecurity & Privacy Research and Public Policy at Comcast, to talk about developer-centric threat modeling. We start by looking at ways to make threat modeling more appealing to developers. We discuss how a security team can help developers participate in threat modeling in the midst of continual change with both development and security teams. Ultimately, a threat modeling program is only as effective as the value it offers to a diverse group of stakeholders. We discuss how to measure and align the value of threat modeling across project, program, and executive levels. We conclude with Vaibhav’s thoughts about where he thinks developer-centric threat modeling is heading over the next 12 to 18 months.

Today we are joined by Simone Curzi, Principal Consultant at Microsoft, to talk about some of the challenges we face today with conducting threat modeling. We will discuss how value creation in threat modeling is tied to the developer community and, ultimately, to the business. Our discussion will then look at how threat modeling must continue to evolve in light of our DevOps delivery cycles. We will conclude with a brief discussion on how organizations can operationalize a threat modeling practice.

Today we are once again joined by Kyle Lai, Founder and CISO of KLC Consulting, to talk about CMMC. We will start by discussing the differences between CMMC 1.0 and CMMC 2.0 and discuss the timeline for CMMC 2.0 rulemaking. Our discussion will also look at CMMC 2.0 both from an assessor’s perspective and a Defense contractor’s perspective. Specifically, how an assessor should manage the change if they are already invested in CMMC 1.0 and next steps for a Defense contractor to do before CMMC 2.0 rulemaking is complete. CMMC impacts a broad ecosystem and being aware of the changes can help organizations prepare for the transition.

Today we are joined by Nick Deshpande to talk about data governance and security. We will start by introducing the concept of data governance and the business importance of data governance. We will dig deeper and discuss who is responsible for creating and managing a data governance program. When looking at data governance as an enabler, we will turn our attention to three use cases: DevSecOps, Threat Modeling, and Zero Trust. In concluding, Nick will share his thoughts on where he sees data governance evolving over the next 12-18 months.

Today we are joined by K Royal, Associate General Counsel & DPO of TrustArc, to talk about Software Development and Privacy. We will start by discussing what the intersection of privacy and software development looks like. We will examine the essential competencies required to produce privacy compliant software and touch on automated privacy checking in the context of DevSecOps pipelines. We will conclude by discussing where privacy is headed in the next 12-18 months. Producing privacy compliant software is becoming increasingly important in light of government regulations.

Today we are joined by Michael Isbitski, Technical Evangelist at Salt Security, to talk about API Security. Our systems and platforms today are largely driven by API integrations. We will start by discussing ownership of API security in an organization. This will lead into a discussion about convincing a business stakeholder to invest in API security. Given how complex our applications are today, we will talk about some of the biggest challenges with securing our APIs. As security paradigms continue to evolve, we have gone from perimeter based security to Zero Trust. We will conclude by discussing how API security fits into Zero Trust.

Today we are joined by Rob Akershoek from DXC, to talk about security reference architectures. We will start by discussing why we need a security reference architecture. This will lead us into governance and who is responsible for creating a security reference architecture. Since we don’t have a standard security reference architecture in the industry, we will explain how to start creating a security reference architecture. In conclusion, we will share some of the work being done by The Open Group around security reference architectures.

In this episode, Clay Carter talks about product security in our critical infrastructure- specifically, water! Clay discusses the unique challenges and opportunities of product security in the water industry, the intersection with business partners like safety, importance of domain expertise, and the effect of seeing the products you help secure impact your day to day life.