In this episode, Katie Norton (Research Manager at IDC) gives a primer on tech industry analysts. The conversation provides insights on how to find the right analyst firm based on company needs and the importance of asking good questions during consultations. Additionally, they address common myths about analysts being 'pay to play' and examine the impact of recent npm supply chain attacks on the industry.
00:00 Introduction: Analyst vs. Consultant
02:12 Finding the Right Analyst Firm
04:27 The Importance of Asking Good Questions
07:30 Debunking the 'Pay to Play' Myth
10:55 Current Trends in Malware and Supply Chain Security
16:17 Understanding Application Security Posture Management (ASPM)
22:32 Conclusion: Navigating the Analyst Landscape
Learn how a tech industry analyst could help you research new tools or practices.
Adam Shostack is one of the best known thought leaders and instructors in threat modeling. At the October 2025 LeanAppSec Live, we invited him to deliver a lightning talk on the four question framework.
Discover how to efficiently incorporate threat modeling into your security processes without extra budget or headcount.
