CISOs are struggling to threat-model AI. Can 15-minute sessions help?

CISOs are struggling to threat-model AI. Can 15-minute sessions help?

A few weeks ago, on a busy day, threat-modeling expert Adam Shostack opened an email from a client. Someone at that organization had vibe-coded an app and put it to work with customer data. Now, the client wanted to know what risks the tool posed. And what it should do about them. They needed answers quickly, so Shostack gave himself 15 minutes to analyze the system. Soon, he had “a list of meaningful threats,” including hallucination and bias, …