DevArmor

We automate threat modeling. AI-native. Dev-first. AppSec that keeps up with your shipping speed.

[DevArmor @devarmorHQ]

@NightmareJS Good stuff! Thanks for sharing

[DevArmor @devarmorHQ]

@SaraDiscovers Start from console.log("Hello, World!");

[DevArmor @devarmorHQ]

We are here at @fwdcloudsec in #Bellevue.
Right next to @AnthropicAI, table #14!

[DevArmor @devarmorHQ]

@cnotin @fwdcloudsec @popov1ron Great talk!

[DevArmor @devarmorHQ]

@security_sesha Thank you @security_sesha

[DevArmor @devarmorHQ]

@myselfshubhendu CTM on this table is the one that matters most and gets the least attention. most teams pick a methodology and run it once. the ones that actually work make it continuous, tied to how the architecture changes not how the calendar moves.
This is what we work on at DevArmor!

[DevArmor @devarmorHQ]

@SCAuditStudio @aviggiano @monad minimal prompts work when you're hunting known bug patterns. but for design-level flaws (broken access control, missing trust boundaries) the AI needs more context not less. it needs to understand the architecture. the prompt is basically the threat model.

[DevArmor @devarmorHQ]

@aviggiano @SCAuditStudio @monad @Fried_rice the threat modeling part is key. without it, AI agents just find the same implementation bugs scanners already catch. the design-level flaws (broken trust boundaries, missing auth paths) need business context that only a threat model provides. thats where the real signal is.

[DevArmor @devarmorHQ]

@marcobravoram @LinkedIn the rejected-alternatives section of the ADR is genuinely underrated. most threat models capture what you decided but not what you explicitly said no to.. that's usually where the real security reasoning lives. we think about this a lot at DevArmor.

[Marco Bravo @marcobravoram]

Check out my latest article: 5 Practices for Threat Modeling at DevSecOps Speed https://t.co/GWhoTq9V4W via @LinkedIn

[DevArmor @devarmorHQ]

@Americanfort_io the attack didn't exploit a bug in the code. it exploited a gap in the design. no trust boundaries between what the agent received and what it could execute.. this is why we think threat modeling agents at design time isn't optional anymore.

[DevArmor @devarmorHQ]

@AndrewLarson17 @Americanfort_io this isnt an input validation failure. it's an architecture failure. the agent's trust model treated every input as instructions with full authority. no amount of input filtering fixes a design where the agent can't distinguish commands from data.

[DevArmor @devarmorHQ]

@nagarjuncreates @MarcelVelica Second that!
We are building the AI-native control plane for AppSec
Secure-by-design for the agentic era.

[DevArmor @devarmorHQ]

@alver1301 @dac_chain "quantum-proof" is a marketing property. not a security property. the right frame is exactly what you said: per-layer threat models with explicit assumptions about what holds today and what needs a migration path. most projects cant answer that honestly yet.
Check out our work!

[DevArmor @devarmorHQ]

We are concluding penetration tests on @SpursOfficial trophy cabinet firewall. Good news: threat modeling suggests the assets inside have been air-gapped from the rest of the #EPL since 1961,so data loss risk remains completely negligible

[adédayò • ajíbóyè @D1Olu]

We are concluding penetration tests on @Arsenal trophy cabinet firewall.

Good news: threat modeling suggests the assets inside have been air-gapped from the rest of the #EPL since 2004, so data loss risk remains completely negligible

[DevArmor @devarmorHQ]

@D1Olu @Arsenal big congrats to @Arsenal on the title. naturally we pivoted our pentest to @SpursOfficial trophy cabinet firewall.. threat modeling suggests the assets inside have been air-gapped from the #EPL since 1961, so data loss risk remains completely negligible

[DevArmor @devarmorHQ]

@avisre @kiransing @just_adev @levelsio @TermiusHQ glad someone said threat modeling and not just 'more tests.' tests validate the code does what you told it to. threat modeling validates you told it the right thing. when AI writes the code that's the part that matters most, and its where we focus @devarmorHQ

[DevArmor @devarmorHQ]

@RealJohnnyTime Well said! 'what assumption failed' is the most underrated question in security. controls and signals are implementation fixes. the assumption is the design mistake, and thats where the real money is lost every time.
That's what we're trying to solve at DevArmor.

[DevArmor @devarmorHQ]

@studiojin_dev Check this blog post:
https://t.co/127ip0nzVm

[DevArmor @devarmorHQ]

@studiojin_dev the model dependence part is the real takeaway. rules give you structure but the ceiling is always how much context about the actual system the tool can work with.. curious how it handles business logic and auth flows vs code-level patterns.
We have a blog post about this: