Don't just model the attack, model the recovery with Petra Vukmirovic

My guest today is Petra Vukmirovic, Head of Information Security and IT at Numan, and she also works with DevArmor on automating threat modeling and security design reviews. Outside of that she started the OWASP Threat Model Library, an open collection of real threat models the community can learn from.What makes her path unusual is that she didn't come to AppSec through development, she came through emergency medicine, where she worked as a doctor.In this episode, we talked about what transfers from the ER to incident response, which is mostly the protocols: risk scores, runbooks, decision trees you can follow when things are on fire. She also thinks threat modeling stops too early. Most teams model protective controls and stop, when recovery deserves the same attention. We also got into automating threat models with LLMs, catching drift between the model and the code, and where design reviews end and threat modeling begins.And much more!This podcast is brought to you byEscape: https://escape.tech  — Offensive security for the teams that are 100x outnumbered, combining Attack Surface Management, business-logic-aware DAST and AI pentesting solutions.