BSidesSF 2026 - Your Threat Model Is Lying to You: Why Modeling the Design Isn’t... (Farshad Abasi)

This talk features Farshad Abasi discussing the shortcomings of traditional threat modeling approaches that focus on intended designs rather than actual deployments. The speaker highlights the critical blind spot this creates and presents strategies to enhance threat modeling by integrating real findings from Static Application Security Testing (SAST), Software Composition Analysis (SCA), Dynamic Application Security Testing (DAST), Infrastructure as Code (IaC), and cloud security assessments. Attendees will gain insights into evolving their threat modeling practices to better align with real-world conditions and vulnerabilities.