Vikramaditya Narayan builds and presents Precogly, an open-source platform for threat modeling that helps security teams map systems, identify threats, and work across teams without commercial-tool licensing costs.
Vikramaditya Narayan is most useful for technical webinars on open-source threat modeling for enterprise AppSec teams.
Best for
A cloud security vendor planning a technical webinar on scaling open-source threat modeling.
Not for
Beginner coding courses, career-change advice, or YouTube pre-roll endorsement campaigns.
Key takeaways
Threat modeling can stall as neglected diagrams and threat lists.
Precogly is open source and supports visual data-flow diagrams, threat libraries, compliance traceability, collaboration, import/export.
Presented OWASP Precogly at Arsenal BlackHat and selected for VulnCon Bangalore.
Check first: Confirm sponsorship terms, rate card, partnership contact, and recent webinar or talk results.
Main ideas
Threat modeling fails in the gap between enterprise-priced tools and simple open-source ones · Software should be shaped by the practitioners who live with the problem · A threat model should sit alongside frameworks, compliance requirements, and other tools
Vikramaditya Narayan builds Precogly, an open-source threat-modeling platform for security teams.
Their launch post describes a practical problem: threat models can stall as neglected diagrams and threat lists, while commercial tools may be costly and simpler alternatives difficult to scale.
Precogly is designed to support ongoing team work with a visual data-flow-diagram editor, threat-library mappings, compliance traceability, collaboration, and import/export.
Narayan makes threat modeling tangible, linking an operational pain point to a specific tool and describing practitioner feedback as part of its development: more than 100 people, including OWASP threat-modeling leaders, contributed ideas.
They also share the work with the security community, including at BlackHat Arsenal and VulnCon.
Vikramaditya Narayan's public posts argue one main position: threat modeling should be continuous and scalable for ordinary AppSec teams, but the market leaves them stuck between enterprise-priced commercial platforms and open-source tools too simple to grow with.
Read more
Their answer is Precogly, an open-source threat modeling platform framed as enterprise-grade without licensing costs or vendor lock-in, built from practitioner feedback rather than company assumptions. The posts also show a second, quieter priority: taking that work into security communities, both flagship events such as Black Hat Arsenal and regional ones such as VulnCon in Bangalore, while crediting the people who make those events and the tool possible.
Threat modeling fails in the gap between enterprise-priced tools and simple open-source ones
Narayan argues that AppSec leads genuinely want continuous threat modeling and want AI to help scale it, but the available options push them back to square one.
Read more
Commercial platforms are priced for organizations with six-figure security budgets, so teams hit a paywall; open-source alternatives are too simple to scale across an organization; and building in-house, even with AI coding assistants, would take months.
The result, they say, is that threat modeling either does not happen or happens badly, leaving stale hand-drawn diagrams and AI-generated threat lists nobody acts on.
Precogly is presented as the tool they wanted to exist, not a compromise between the two bad options.
The launch post lists what teams are left with: a hand-drawn diagram and a list of AI-generated threats nobody updates or implements. Precogly is offered as an open-source platform with a visual data-flow-diagram editor, library packs, team collaboration, and TM-BOM import and export.
The framing is not anti-commercial-tool as such. Narayan keeps the enterprise capability claim and drops the cost and lock-in, describing Precogly as "enterprise-grade, open-source, no lock-in" rather than a lighter tool for smaller teams.
Software should be shaped by the practitioners who live with the problem
Narayan attributes Precogly's design to the people who described the problem first.
Read more
The launch post says more than 100 practitioners shared their time and frustrations, including many threat modeling leaders from OWASP, and credits them with shaping every design decision.
This is a stated priority: the tool's feature set reflects operational complaints drawn out through direct conversations.
The post closes by asking security architects and threat modeling practitioners who have been "making do" to try it and report back.
Narayan writes that the project would not exist without the generosity of those practitioners, and thanks them directly: "You shaped every design decision."
A threat model should sit alongside frameworks, compliance requirements, and other tools
Narayan treats threat modeling as something that has to connect to the rest of a security program rather than end as a diagram.
Read more
The Precogly post describes library packs mapped to MITRE ATT&CK, STRIDE, CAPEC, and CWE, plus compliance traceability to DORA, NIST CSF, SOC 2 and others.
It also highlights TM-BOM import and export for interoperability, and describes the platform as AI-ready.
The underlying argument is that models should be portable and reusable across the frameworks and reporting obligations teams already work in, with open exchange formats reducing vendor lock-in.
The post names framework mappings, compliance frameworks, team collaboration, TM-BOM import and export, and AI readiness as features that make the platform usable inside an organization rather than as an isolated exercise.
In-person conferences are valuable for people and ideas, not just presentations
After presenting OWASP Precogly at the Black Hat Arsenal in 2026, Narayan argues that physical conferences are an opportunity to connect with other people and exchange ideas, and describes the conversations as the memorable part of the event.
Read more
The post highlights adjacent work by naming practitioners and the specific themes they were working on: AI-powered threat modeling workshops, an announced taxonomy for agentic threats, open-source release governance, AI-powered pentesting, macOS data theft, JavaScript malware detection, and post-quantum readiness. It also thanks the event organizer for running it.
Narayan credits Adam Shostack with announcing a new taxonomy for agentic threats called PHANTOM-B, and Marco M. with leading community workshops on AI-powered threat modeling. Both are presented as ideas encountered at the conference.
Regional security communities deserve the same visibility as flagship events
Narayan's VulnCon post makes a case for the Asian security community as a serious venue rather than a minor stopover.
Read more
They describe VULNCON as one of the top emerging security events in the region, note support from recognized practitioners, and treat selection to present Precogly in its Arsenal section as a significant milestone.
The post credits the event's co-founders for building a platform for the regional community and invites readers to join a set of named practitioners for two days of learning and networking.
The argument is that emerging regional events are where the community grows, and presenting there is part of the same work as presenting at Black Hat.
The post gives practical detail for readers: June 12 and 13 at Nimhans Convention Centre, Bangalore, with thanks to co-founders Hitesh Patra and Bipul Jaiswal for creating the platform.
This is the clearest starting point for understanding what Narayan built and which AppSec problem it addresses.
Read more
It lays out the product scope, open-source positioning and practitioner research behind Precogly.
Narayan explains the problem that led to Precogly: AppSec leads want continuous threat modeling and AI help, but commercial tools are priced for six-figure enterprise security budgets, while open-source alternatives are too simple to scale.
The result, they write, is that threat modeling either does not happen or happens badly, leaving hand-drawn diagrams and AI-generated threats that nobody updates.
Precogly is presented as an open-source threat modeling platform with a visual DFD editor, library packs mapped to MITRE ATT&CK, STRIDE, CAPEC, and CWE, compliance traceability to DORA, NIST CSF, SOC 2, team collaboration, TM-BOM import/export, and AI readiness.
More than 100 practitioners, including many OWASP threat modeling leaders, shared time and frustrations that shaped the design.
For brands planning a campaign
For a cloud security vendor, this post offers the problem framing and proof points for a technical webinar on scaling open-source threat modeling without enterprise licensing costs.
One angle: have Narayan walk through the gap between commercial tools, basic open-source tools and the continuous threat modeling Precogly targets.
A secondary use is a live comparison of open-source and commercial tradeoffs for an AppSec audience.
This post shows how Narayan presents Precogly at a major security conference and which adjacent trends and practitioners they engage with.
Read more
It positions them as an active Arsenal presenter as well as a tool builder.
Narayan describes presenting OWASP Precogly at Arsenal BlackHat 2026 as a standout experience and argues that physical conferences connect people and foster the exchange of ideas.
The post names people and themes from the event, including Marco M. leading AI-powered threat modeling workshops, Adam Shostack announcing a taxonomy for agentic threats called PHANTOM-B, Dharshan Shanthamurthy of SISA, Keshav Kamble of Avocado Systems, Bob Lord of Hacklore.org, and others working on open-source release governance, AI-powered pentesting, macOS data theft, JavaScript malware detection, and post-quantum readiness.
Narayan also thanks Lisa Hatley-Nasr for organizing the event.
For brands planning a campaign
A vendor webinar can use this recap to position Narayan around live community themes such as AI-powered threat modeling and agentic threats. The post also offers concrete conference context for a technical session; don’t present the named individuals as endorsing Narayan or Precogly.
This item shows Narayan presenting at a regional Asian security event and gives a practical example of how the work is shared with the community.
Read more
It also illustrates Precogly’s regional visibility.
Narayan announces selection to present OWASP Precogly in the Arsenal section of VulnCon, describing VULNCON as one of the top emerging security events in the Asian region and citing support from people including Donavan Cheah and Vandana Verma.
The post invites readers to join other named security practitioners for two days of learning and networking, with dates June 12 and 13 at Nimhans Convention Centre, Bangalore.
Narayan thanks co-founders Hitesh Patra and Bipul Jaiswal for building a regional cybersecurity community platform.
For brands planning a campaign
For an APAC- or India-focused campaign, this post supports scheduling a webinar or event in a relevant time zone and offers context on Narayan’s community-event experience. Ask for audience and partnership details before using it to assess reach or paid-promotion experience.
Narayan frames Precogly around a recurring operational problem: teams want continuous threat modeling, but commercial tools can be costly and simpler alternatives may not scale.
Read more
The post describes an open-source platform with a visual data-flow diagram editor, team collaboration, and AI-ready workflows.
The launch post starts with practitioner pain points, contrasts commercial and open-source options, then lists product capabilities. Narayan says more than 100 practitioners contributed feedback to design decisions.
For brands planning a campaign
A webinar for enterprise AppSec teams could use this problem-to-tool framing to discuss how to make threat modeling repeatable. Ask Narayan to demonstrate a process and explain where a tool helps—and where teams still need practitioners to act on identified threats.
The Precogly launch post names library packs mapped to MITRE ATT&CK, STRIDE, CAPEC, and CWE; compliance traceability to DORA, NIST CSF, and SOC 2; and TM-BOM import and data export.
Read more
This connects threat modeling to security references and compliance work, not just diagramming.
For brands planning a campaign
A technical session could examine how teams relate threat-model findings to existing frameworks and compliance requirements.
The post lists these capabilities but doesn’t show how teams use them or how deeply each integration works.
Ask which integrations Narayan can demonstrate and what their limits are.
Presenting security tools and learning with the community
Two event-related posts describe presenting OWASP Precogly: one says Narayan was selected to present it in Vulncon’s Arsenal section, and another recounts presenting it at Black Hat Arsenal in 2026.
Read more
The Black Hat post emphasizes meeting practitioners and exchanging ideas, alongside examples of other security tools and research presented at the event.
The event posts use selection and presentation milestones to introduce the tool, then spotlight other practitioners, projects, and community exchange.
For brands planning a campaign
Narayan’s posts support considering a practitioner-facing webinar that combines a Precogly walkthrough with discussion of threat-modeling problems and peer feedback. Before booking, ask for audience size, webinar experience, and measured outcomes.
Their posts tie relationships to Precogly, the open-source threat-modeling platform they say they built and released publicly.
Read more
They also mention OWASP, vendor-neutral security framework mapping and two conference Arsenals where Precogly was presented. Ask for clarification on any sponsorship, affiliate, client or investment relationship.
Precogly
Owned business
Vikramaditya Narayan says they built and open-sourced Precogly after months of work, calling it an open-source threat-modeling platform and an alternative to commercial tools without licensing costs or vendor lock-in.
Read more
Its listed capabilities include a visual data-flow-diagram editor, library packs mapped to MITRE ATT&CK, STRIDE, CAPEC and CWE, compliance traceability to DORA, NIST CSF and SOC 2, team collaboration, and TM-BOM import/export. The posts do not mention a company, funding or paid offer around the project.
Posts call the project “OWASP Precogly” and describe presenting it in Arsenal sections at security events.
Read more
They credit “many threat modeling leaders from OWASP” among the 100+ practitioners who shaped the design. The posts do not state a formal OWASP project role, membership or project status.
They describe presenting OWASP Precogly in the Arsenal section of Black Hat 2026 and count conference encounters among the reasons to attend in-person events.
Read more
The post records a speaking appearance, not a sponsorship or commercial engagement.
They say they were selected to present OWASP Precogly in the Arsenal section of VULNCON, described as an emerging Asian security event held June 12–13 at the Nimhans Convention Centre, Bangalore.
Read more
The post records a speaking appearance, not a sponsorship or commercial engagement.
Narayan’s posts offer a starting point for readers following application security tooling, threat modeling, and public discussion of security problems.
Read more
Start with the Precogly launch post, which explains the problem they set out to solve: teams want continuous threat modeling, but commercial tools are priced for large security budgets and simpler open-source options may not scale.
Then read the Black Hat Arsenal 2026 recap for the ideas and people they encountered, including AI-powered threat modeling, agentic threats, and open-source release governance.
The VulnCon post adds regional community work in Bangalore.
The through-line is an open-source threat-modeling platform, framework mappings, and conference conversations with practitioners.
Threat modelingApplication securityOpen-source security toolsSecurity frameworks and mappingsAI in securityOWASPSecurity conferencesConference presentationsLinkedIn postsAppSec teamsSecurity architectsThreat modeling practitioners
Dario Salice
Salice works in the same security conversation through interviews and podcasts.
Read more
The Inverted Podcast episodes here cover agentic AI and digital identity with Nick Steele from OpenAI, and retiring outdated cybersecurity advice with Bob Lord of Hacklore.org. Narayan’s Black Hat recap also points to Bob Lord and Hacklore.org, and both creators use named practitioners to explain emerging security problems.
Salice’s public posts here host and curate conversations; Narayan’s center on building and presenting an open-source threat-modeling platform and on conference community work.
Both engage with OWASP and the wider cybersecurity community.
Read more
Eldeeb posts recaps of an AmCham Egypt panel on cybersecurity in the "New Normal," AI, and quantum computing, and an OWASP Cairo panel on responsible cybersecurity news and deglobalization. Narayan credits OWASP threat-modeling leaders and presents OWASP Precogly at security events.
Eldeeb’s examples focus on regional policy, governance, quantum risk, and panel discussion; Narayan’s focus on application security tooling, threat modeling, and open-source product design.
Both use LinkedIn to support and connect the cybersecurity community.
Read more
Meece’s posts open a network to job seekers and describe co-curating Stronger Together: Women in Cybersecurity, a book whose proceeds go to WiCyS scholarships. Narayan’s posts thank practitioners who shaped Precogly and credit event organizers and community leaders.
Meece’s published focus here is career access, networking, allyship, and DEI in cybersecurity; Narayan’s is technical threat-modeling tooling and conference presentations.
Vikramaditya Narayan’s audience information is mostly qualitative.
Read more
The only available figure is a LinkedIn follower count of 5,506, observed 9 October 2026.
Three LinkedIn posts (19 March, 6 June and 7 August 2026) point to an audience of AppSec and threat modeling practitioners.
The Precogly launch post says it was built after conversations with AppSec leads and 100+ practitioners, including threat modeling leaders from OWASP, and invites security architects and threat modeling practitioners to try it.
The Black Hat Arsenal post names the security founders, tool creators and presenters they met there; the Vulncon post names security speakers and organisers around an Arsenal presentation.
For a cloud security vendor planning a technical webinar on scaling open-source threat modeling for enterprise AppSec teams, these posts offer a useful topic signal: they address continuous threat modeling, scaling it with AI, and the gap between enterprise-priced commercial tools and too-simple open-source options.
But follower count and post topics do not establish how many followers are enterprise AppSec buyers, where they are based, or how they respond to long-form technical content.
The posts have no engagement counts, and no other publishing platform is identified.
Before booking, ask for results from comparable work—a technical webinar, conference Arsenal session or long-form talk on threat modeling—including registration or attendance numbers, completion or watch-through, and the level of Q&A or practitioner questions.
Ask whether audience survey or LinkedIn analytics data is available: demographic data can show geography, age and gender, but employer, job title and seniority require a survey or another documented source.
If reaching enterprise AppSec decision-makers is essential, request that professional breakdown.
Vikramaditya Narayan’s posts focus on building and presenting Precogly, an open-source threat modeling platform, and on conference appearances.
Read more
They don’t describe sponsorships, advertising, paid partnerships, a rate card, media kit, sponsored formats, sponsor policy, or partnership contact route.
For a cloud security vendor planning a technical webinar, the posts point to a direct professional approach around Precogly and threat modeling, not a paid placement.
Ask directly whether they accept sponsorship and confirm terms before budgeting.
Good fit. The topic, audience and presentation experience in their posts align with the webinar brief.
Read more
Brief
A cloud security vendor wants to propose a technical webinar on scaling open-source threat modeling for enterprise AppSec teams.
Reasons
Narayan's Precogly launch post describes a problem a cloud security vendor could address in a webinar: AppSec leads want continuous threat modeling and AI help, but commercial tools are priced for six-figure budgets while simpler open-source tools do not scale. That framing gives the webinar a concrete starting point practitioners will recognise.
The post lists Precogly features relevant to enterprise AppSec: a visual data-flow-diagram editor, library packs mapped to MITRE ATT&CK, STRIDE, CAPEC and CWE, compliance traceability to DORA, NIST CSF and SOC 2, team collaboration, and TM-BOM import/export. These offer demonstration points and discussion anchors.
Narayan has presented OWASP Precogly at two security events: the Arsenal at Black Hat 2026 and a Vulncon Arsenal session in Bangalore. That experience indicates familiarity with technical conference audiences.
The audience section shows content aimed at AppSec and threat modeling practitioners, the same group a cloud security vendor would want at a technical webinar. The launch post invites security architects and threat modeling practitioners to try the tool.
The topics section shows Narayan connecting threat modeling to security frameworks and compliance work, giving a webinar scope beyond a product demo: how teams make threat modeling repeatable.
Caveats
Vikramaditya Narayan's LinkedIn posts do not say anything about measured composition data for the following beyond a follower count of 5,506 observed on 9 October 2026. Narayan's posts do not say how many webinar registrations, attendees, or watch-throughs there were.
The partnerships section lists no sponsorship terms, rate card or partnership contact. Confirm these directly before budgeting.
Before committing, ask for recent results from a comparable technical webinar or talk: registration, attendance, completion and Q&A depth. Confirm whether the vendor wants a co-presenter or a solo session.
When to choose a specialist
Poor fit. The audience, topic, format and commercial relationship fall outside what Narayan's posts and profile sections show about their work.
Read more
Brief
A developer bootcamp wants a YouTube pre-roll ad campaign featuring Narayan endorsing its beginner coding course to career-changers.
Reasons
Narayan's posts focus on enterprise AppSec and threat modeling, not beginner coding or career-change advice. The topics and profile sections record threat modeling, security frameworks and conference presentations, none of which supports an endorsement for a course aimed at new coders.
The audience section shows content aimed at AppSec leads, security architects and threat modeling practitioners. A campaign targeting career-changers needs a different audience; ask for evidence of reach among beginners.
The proposed format is a short paid endorsement in a YouTube pre-roll ad. Narayan's posts show conference presentations and LinkedIn posts, not short-form video ads or product endorsements. Their profile lists no sponsorship formats; confirm whether they offer this kind of placement.
Narayan's posts cover LinkedIn only and do not demonstrate a YouTube audience. Ask for YouTube audience figures before considering a pre-roll campaign.
Caveats
This assessment is based on Narayan's posts and profile sections. Ask about other channels or commercial work if they could affect the fit.
The topic and audience mismatch would remain unless Narayan's broader content includes beginner-facing coding or career content, even if the commercial terms were acceptable.
A worked campaign example
Brief
The good-fit brief: a cloud security vendor wants a technical webinar on scaling open-source threat modeling for enterprise AppSec teams.
Campaign angle
A 45-minute technical webinar titled 'From hand-drawn diagrams to continuous threat modeling: an open-source path for enterprise AppSec'. Narayan presents the problem, walks through Precogly as an open-source alternative and shows how a vendor's cloud security product can complement that workflow.
Next steps
Confirm Narayan's availability and fee or terms directly; the partnerships section lists no sponsorship route.
Ask for recent webinar or talk metrics—registration, attendance, completion and Q&A depth—because the audience section lists no such figures.
Ensure the vendor segment does not undercut Precogly's open-source positioning. The launch post frames Precogly as an alternative to expensive commercial tools, so position the vendor as a complement, not a replacement.
Agree before the webinar whether the session will be recorded and whether the recording can be used as a gated asset.
Outline
Opening (5 minutes): Narayan introduces the problem from the Precogly launch post: teams want continuous threat modeling and AI help, but commercial tools are priced for six-figure enterprise budgets and simpler open-source options do not scale. The result is threat modeling that either does not happen or happens badly, leaving stale diagrams and unused AI-generated threats.
Middle (25 minutes): Narayan demonstrates Precogly's approach using concrete capabilities from the launch post: a visual DFD editor; library packs mapped to MITRE ATT&CK, STRIDE, CAPEC and CWE; compliance traceability to DORA, NIST CSF and SOC 2; team collaboration; and TM-BOM import/export. They can also explain how more than 100 practitioners, including OWASP threat modeling leaders, shaped the design.
Vendor segment (5 minutes): The sponsoring vendor shows how its cloud security product complements open-source threat modeling—for example, by consuming threat model outputs or providing runtime context. The segment should complement, not contradict, the open-source message.
Q&A (10 minutes): Narayan takes practitioner questions. The Black Hat Arsenal post shows they value exchange with other practitioners, making live Q&A a natural format.
Promotion
Promote through Narayan's LinkedIn following and relevant security communities. The Vulncon post shows they can mobilise a regional security audience for an event; the same approach can support webinar registration.
Choose Meece for a community and careers session rather than a deep technical one—for example, reaching people entering cybersecurity and the hiring managers who recruit them.
Read more
The posts point in two directions: a co-curated book, Stronger Together: Women in Cybersecurity, with more than 100 contributors and proceeds donated to WiCyS scholarships; and a networking post that opens Meece's connections to job seekers and names professionals and hiring managers worth following. A session on breaking into the field, male allyship, or using LinkedIn for a security job search fits the posts.
Neither post touches threat modeling, AppSec tooling, or enterprise security architecture, so Meece cannot provide the technical content a webinar for AppSec leads with budget authority needs. The audience is career-changers and job seekers, not the AppSec leads the vendor wants to reach.
Choose Eldeeb when the webinar belongs at the governance and risk layer rather than the tooling layer—quantum-safe migration, crypto-agility, supply chain exposure, data sovereignty, or compliance burden across national and regional enterprises.
Read more
The AmCham Egypt panel post examines the quantum threat to current cryptography, the case for cryptographic asset inventories, risk assessment, and crypto-agility, and cites Microsoft material on quantum-safe preparation and AI governance.
The OWASP Cairo post covers supply chain risk, dependence on global providers, national sovereignty over data, compliance complexity, and exposure to geopolitical change.
A vendor selling crypto-agility, risk inventory, or governance tooling would get more from Eldeeb's framing than from a threat-modeling demo.
The two posts date from mid and late 2023 and offer panel commentary, not build-in-public work on a tool.
Their framing is regional—Egypt and the wider MENA enterprise context—while the vendor wants to reach enterprise AppSec teams generally.
For a hands-on walkthrough of a data-flow-diagram editor, ATT&CK-mapped library packs, or TM-BOM exchange, ask Eldeeb for a separate demonstration.
Choose Salice for a hosted conversation rather than a presented demo—an episode on how identity, permissions, and security change when AI agents act autonomously, or on which pieces of security advice should be retired.
Read more
The Inverted Podcast post with an OpenAI guest frames agentic AI security questions for listeners and argues that vendors and standards bodies are already investing in making AI systems easier to control.
The Hacklore episode with Bob Lord shows Salice can draw a senior guest and turn a thesis—that outdated security myths are dangerous—into an episode.
A vendor focused on emerging risk and identity would find the interview format a natural fit.
Salice's posts show interviewing and commentary, not hands-on threat-modeling tooling or enterprise AppSec delivery.
Ask for a separate technical demonstration if the session must cover a workflow or implementation questions live.
The output is also a different asset: a podcast episode with its own distribution and subscription mechanics, not the recorded technical webinar with a Q&A segment the vendor needs.
This profile draws on three LinkedIn posts about Precogly’s launch, its presentation at Black Hat Arsenal 2026, and its selection for the VULNCON Arsenal.
The posts describe the platform’s purpose and features, practitioner contributions, and conference activity.
The profile summarizes those posts and the related topics, relationships, and campaign-fit sections; it does not assess Precogly’s code or verify event claims independently.
