How Large Regulated Enterprises Actually Buy AI
The enterprise AI purchasing journey seen from the security gate: the five stages, the three evaluation layers, and the residency traps hiding in vendor documentation.
Read articletopic / AI Security
AI Security.
AI systems break the boundary between code and data. Threat models built before LLMs miss most of what matters. Notes on red teaming, threat modeling for agents, and the practitioner's view of what classical security thinking can and cannot say about a model.
Writing under this topic.
7 posts.
We Teach Security Backwards: I Put AI Red-Teaming on Day 2 and Never Got There
I designed a two-day workshop with AI red-teaming as a full module, not a closing talk. We finished three of eight sessions. The classics ate both days.
Read articleThreat Modeling Generative AI: What 11,658 Incidents and the Research Actually Show
Most real-world harm from generative AI does not come from prompt injection. Analysis of 11,658 incidents shows output handling and misinformation dominate.
Read articleWhy STRIDE Breaks When You Threat Model AI Agents
STRIDE was built for deterministic systems. Agentic AI breaks its core assumptions. Here is a five-zone method that actually finds EchoLeak-class attacks.
Read articleRed Teaming Generative AI: Language as the New Exploit Vector
Prompts are payloads. Why classical red-teaming misses LLM-native attacks, and how to design adversarial tests that surface jailbreaks and tool misuse.
Read articleBuild Ironclad ML Security Fast: MAESTRO Framework Explained
CSA's MAESTRO framework, explained for practitioners. Layer-by-layer attack surface, control mapping, and how to apply it to your ML pipeline this week.
Read articleWin the AI Security Battle: Essential Moves for Leaders
Five concrete moves security leaders should make this quarter to keep up with AI adoption, without slowing the teams shipping it.
Read article