Threat modelling is great (but nobody does it)

Threat modelling is like flossing for your security program—everyone knows it's good for them, but hardly anyone does it regularly. This presentation tackles the paradoxical status of threat modelling in cybersecurity: universally recommended but rarely implemented effectively.

Drawing from extensive real-world consulting experience across various industries, sectors and systems, this talk offers an honest assessment of why threat modelling often fails to gain traction despite its recognised value. We'll look at case studies and firsthand accounts to explore the organisational dynamics, resource constraints, and human factors that create a barrier to entry for effective implementation. We will provide a practical guidance on overcoming common obstacles by hosting an interactive threat modelling session, allowing attendees to gain actionable strategies which will help make threat modelling a practical part of their security workflow. This session will show how to make threat modelling real, achievable, and even a little fun.

This talk will have the following sections:

Why Threat Modelling Matters: Establishing the undeniable value of threat modelling as a foundational security practice and how proper implementation can transform security postures and prevent costly breaches.

The Reality Gap: Addressing the real-world barriers preventing widespread adoption, including unclear ownership, perceived skill requirements, and stakeholder management challenges. Through candid case studies from actual engagements, we'll examine incidents where the absence of threat modelling directly contributed to security failures.

Practical Implementation: An interactive threat modelling demonstration that breaks down a system, identifies threats, and shows how the process can be effective without being overwhelming.

What You'll Learn: