Shostack + Associates

Shostack + Associates is a consulting and training firm specializing in threat modeling. Established in 2016 by Adam Shostack, the company helps organizations address technical, organizational, operational, and adoption challenges related to security by design. The firm is built around Adam Shostack's Four Question Framework, a structured approach to threat modeling that has influenced how many practitioners in the field conduct security analysis of systems, applications, and processes. Shostack + Associates works with a network of experienced security practitioners who bring expertise from application security, DevSecOps, GRC, AI security, and product security backgrounds. Services include threat modeling training and instruction delivered at industry events such as OWASP and Black Hat, as well as consulting engagements that help engineering and security teams integrate threat modeling and secure-by-design practices into their development lifecycle. The company also offers an Accelerator Program focused on organizational culture assessment and improvement to support security engineering programs. Their associates have experience across sectors including healthcare, financial services, insurance, and government, and address emerging areas such as AI/ML system security, cloud-native architectures, and medical devices. The company operates primarily through freelance consultants and instructors rather than a large permanent staff, targeting enterprises seeking to build internal threat modeling capability rather than outsourcing security assessments entirely.