What Threat Model Pending is
Threat Model Pending is where I write about application security, AI, agentic systems, incentives, unintended consequences, and the increasingly strange places where all of those things intersect.
Some posts will be technical. Some will be philosophical. Some might even be funny. And some will probably start with dinosaurs and end with Reinforcement Learning.
The common thread is trying to understand how the systems we build actually behave, not just how we intended them to behave.
Who I am
I’m an application security leader who has spent most of my career thinking about how software fails, how people misuse it, and how attackers find paths nobody intended them to find.
Lately, a lot of that thinking has shifted toward AI: how autonomous systems change the threat model, what traditional AppSec still gets right, where it falls short, and what happens when we start giving increasingly capable systems things like tools, memory, permissions, and objectives. Or at least we think we do.
I’m not writing here as an AI researcher with all the answers. I’m writing as a security practitioner trying to ask better questions.
The opinions expressed here are my own and do not represent those of my employer.
How I make this
Full transparency: I use AI to help me write.
Mostly, it acts as an editor, sounding board, research assistant, and occasionally the thing that tells me I’ve wandered three side-quests away from the article I originally started writing.
The ideas, arguments, opinions, and final editorial decisions are mine. AI helps me organize them, challenge them, fact-check things worth checking, and, most importantly, stay on topic.
Trust me, dear Reader. You’d prefer it this way.
Why subscribe?
Subscribe to get full access to the newsletter and publication archives.
Stay up-to-date
Never miss an update—every new post is sent directly to your email inbox. For a spam-free, ad-free reading experience, plus audio and community features, get the Substack app.
Join the crew
Be part of a community of people who share your interests. Participate in the comments section, or support this work with a subscription.
To learn more about the tech platform that powers this publication, visit Substack.com.
