An OWASP SAMM Extension proposal for AI-Driven Development
This document extends OWASP SAMM to systems where software is no longer the only actor.
https://t.co/5f1YAwbYBv
v0.3 highlights
Five additions that emerged from publication consistency review and real audit feedback.
A curated list of tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.
https://t.co/1jvgz45bjQ
ёprstcon — community one-day con in Moscow, May 26.
Open call for anyone whose talk fits the room.
200 people, infosec + unusually curious crowd from
adjacent fields. No sponsors. No VIP. Pallets instead of seats.
ёprstcon is about you, your con, man.
https://t.co/fbe6nr4y4D
From Artifacts to Risk: Auditing Instruction Surfaces in Agent Systems
This paper presents a bottom-up, artifact-centric audit of instruction surfaces in agent systems.
https://t.co/WWZW4ytaHa
OWASP SAMM asks: “Did we build the software securely?”
Agentic SDLC must asks:
Can the system be manipulated into taking unsafe actions after it is built?
That’s what Agentic SAMM is for — an OpenSAMM for AI-driven development.
https://t.co/RAebQkaQhz
#DevSecOps#AIsecurity
Forensic auditor for local AI coding agents (Claude Code, Codex CLI, OpenClaw) and project-surface scanner for repos containing skills, plugins, and MCP manifests.
https://t.co/JEbE5kGPk5
agent-audit is one of the implementation projects in the broader ASAMM effort.
Blackhole is a Python ASGI mock server for black-box scanner testing, education, and reproducible benchmarking.
And every white hat should remember: all requests eventually fall into the black hole.
https://t.co/e6kRUnOmUK
Grafana redteam. Zeronighs 2025 slides.
And if you observe long enough, observability will gaze back into you.
(And it will file a ticket.)
https://t.co/S8Kw0SMQAV
EPSS, KEV, and the Joy of Predicting the Past
a boring question: what if you actually ran patch management using EPSS thresholds? Not in theory. Not in slides. In reality—against vulnerabilities that were already exploited.
https://t.co/p8SK5CCGzd
CyberOK is hiring.
Head of Security Services, [Lead/Senior] Vulnerability Researcher, [Lead/Senior] Penetration Testing Specialist, DevSecOps Team Lead.
https://t.co/jSSQZU25Mf
So apparently someone broke to ICS systems of a US city and changed the chemical composition of water. That could have poisoned thousands of people. The potential humanitarian catastrophe was averted. https://t.co/WPgdPE3Ygq