Brett Crawley is a Principal Application Security Engineer who creates the methods, tools and games that other security practitioners adopt.

He has thirty years in software engineering, the last fifteen of them in application security. At Mimecast his work reaches around 800 people across the company, from engineering and product to security, legal, compliance and leadership. He contributes strategic direction by giving teams the tools they need, the skills to use them and the right questions to ask vendors and engineers. He also speaks at industry conferences. He holds the (ISC)² CISSP, CSSLP and CCSP certifications and is a Full Member of the Chartered Institute of Information Security (MCIIS).

Brett is the author of Threat Modeling Gameplay with EoP (Packt, 2024), with a foreword by Adam Shostack. He also created Elevation of Autonomy, a card game for threat modeling agentic AI systems. It is listed on Adam Shostack's security games page and CyberSec Games produces it as a physical deck. His other games cover email infrastructure, the software supply chain and dependency risk. Build the Brief is about requirements analysis: it helps teams specify the software they are building, non-functional requirements included, before anyone starts building it.

In software supply-chain security, he models dependency estates as graphs rather than lists, to show where the risk actually sits. That work produced the open-source tool sbom-graph. He also built src2sink, which builds a simplified call graph to map an input through internal libraries and services to a sink in another library. This lets AI SAST perform taint analysis across internal libraries without having to analyze everything. Several SAST and SCA vendors now consult him on their products.

He writes about security practice on the Ostering.com blog and in his LinkedIn newsletter, The Blast Radius. His ideas are also the focus of a ten-episode fireside chat series, now running, for CISOs and senior security leaders.

Key Skills: Secure by Design, Privacy by Design, Threat Modeling, AI and Agentic Security, Software Supply Chain Security, SBOM and Graph Analysis, SAST and SCA, Secure Coding.

Brett welcomes connections and opportunities to collaborate on security research, tooling and training.