> Markdown version of [/events/world-congress-2026-north-america/sessions/1440-your-threat-model-is](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1440-your-threat-model-is). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026


- **Event:** World Congress 2026 North America

## Description

Threat modeling was created for a time when the intended design closely matched what shipped. That is no longer true. Most teams still model what they plan to build, including user flows, design decisions, and evil user stories, but they rarely re-evaluate the model against what is actually deployed. Pipelines continuously uncover real risks through SAST, SCA, DAST, IaC scans, and cloud configuration checks, yet those signals are not fed back into the threat model. This creates a growing blind spot where decisions are based on assumptions instead of production truth.

This session shows how to extend threat modeling beyond design and incorporate evidence from the built system. You will learn how to treat discovered vulnerabilities as inputs that evolve the model and how to update the model continuously without waiting for new platforms. The approach is practical and can be adopted with tools most teams already have.

## Speaker

### [Farshad Abasi](https://www.wearedevelopers.com/@farshad-abasi)

CEO/Founder, Eureka DevSecOps + Forward Security


## Related talks at this congress

- [Practical Threat Modeling for Software Developers](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1720-practical-threat) — Mudassir Syed
- [Red Teaming Your LLM App -- A Hands-On Threat Model You Can Reuse](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1428-red-teaming-your-llm) — Saloni Garg
- [The Things Your AI Isn't Telling You](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1710-the-things-your-ai) — Desmond Lamptey
- [It passed auth, then production caught fire](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1703-it-passed-auth-then) — Alex Olivier

## Watch remotely

Can’t make it to San José? Watch this session live with Pro. You also get:

- All full videos, bookmarks, and playlists
- World Congress livestreams

[See pricing](https://www.wearedevelopers.com/pricing)

## Links

- [Get tickets](https://www.wearedevelopers.com/world-congress-north-america/tickets)