Observed weaknesses in security dynamics' client/server protocol. - Adam Shostack (Network Threats, 1996)

Breaking Up Is Hard To Do: Modeling Security Threats for Smart Cards. - Adam Shostack (Smartcard, 1999)

How not to design a privacy system: reflections on the process behind the Freedom product. - Adam Shostack; Ian Goldberg (CFP, 2000)

Privacy Engineering for Digital Rights Management Systems. - Joan Feigenbaum; Michael J. Freedman; Tomas Sander; Adam Shostack (Digital Rights Management Workshop, 2001)

Timing the Application of Security Patches for Optimal Uptime. - Steve Beattie; Seth Arnold; Crispin Cowan; Perry Wagle; Chris Wright 003; Adam Shostack (LISA, 2002)

What Price Privacy? - and why identity theft is about neither identity nor theft. - Adam Shostack; Paul Syverson (Economics of Information Security, 2004)

Avoiding Liability: An Alternative Route to More Secure Products. - Adam Shostack (WEIS, 2005)

Experiences Threat Modeling at Microsoft. - Adam Shostack (MODSEC@MoDELS, 2008)

Control-Alt-Hack: the design and evaluation of a card game for computer security awareness and education. - Tamara Denning; Adam Lerner; Adam Shostack; Tadayoshi Kohno (CCS, 2013)

Control-Alt-Hack™: a card game for computer security outreach and education (abstract only). - Tamara Denning; Tadayoshi Kohno; Adam Shostack (SIGCSE, 2013)

Practical Lessons from Creating the Control-Alt-Hack Card Game and Research Challenges for Games In Education and Research. - Tamara Denning; Adam Shostack; Tadayoshi Kohno (3GSE, 2014)

Elevation of Privilege: Drawing Developers into Threat Modeling. - Adam Shostack (3GSE, 2014)

FUD: a plea for intolerance. - Dinei Florêncio; Cormac Herley; Adam Shostack (Commun. ACM, 2014)

Panel: Empirically-based Secure OS Design. - Sam Weber 001; Adam Shostack; Jon A. Solworth; Mary Ellen Zurko (NSPW, 2017)

Empirical Evaluation of Secure Development Processes (Dagstuhl Seminar 19231). - Adam Shostack; Matthew Smith 001; Sam Weber 001; Mary Ellen Zurko (Dagstuhl Reports, 2019)

Contextualisation of Data Flow Diagrams for Security Analysis. - Shamal Faily; Riccardo Scandariato; Adam Shostack; Laurens Sion; Duncan Ki-Aries (GraMSec@CSF, 2020)

Secure development tools and techniques need more research that will increase their impact and effectiveness in practice. - Adam Shostack; Mary Ellen Zurko (Commun. ACM, 2020)

The Buffet Overflow Café. - Tadayoshi Kohno; Camille Cobb; Ada Lerner; Michelle Lin; Adam Shostack (IEEE Secur. Priv., 2022)

25 Years in Application Security: Looking Back, Looking Forward. - Adam Shostack; Fabio Massacci; Eric Bodden; Antonino Sabetta (IEEE Secur. Priv., 2022)

Fast, Cheap and Good: Lightweight Methods Are Undervalued. - Adam Shostack (CoRR, 2023)

Nothing Is Good Enough: Fast and Cheap Are Undervalued as Influencers of Security Tool Adoption. - Adam Shostack (IEEE Secur. Priv., 2023)

Handling Pandemic-Scale Cyber Threats: Lessons from COVID-19. - Josiah Dykstra; Adam Shostack (NSPW, 2024)

The Boy Who Survived: Removing Harry Potter from an LLM is harder than reported. - Adam Shostack (CoRR, 2024)

Who Are "We"? Power Centers in Threat Modeling. - Adam Shostack (CoRR, 2025)

Lessons for Cybersecurity from the American Public Health System. - Adam Shostack; L. Jean Camp; Yi Ting Chua 001; Josiah Dykstra; Brian LaMacchia; Daniel Lopresti (CoRR, 2025)