Threat modelling LLM features and agents, securing tool use, and the guardrails AI-assisted engineering needs.
Active
Service accounts, CI/CD runners, API keys and now AI agents outnumber the people in most organisations, and few of them have an owner. A practical governance model built on inventory, human ownership, least privilege and short-lived credentials that works across clouds and SaaS.
Active
What changes in an application security programme when a growing share of code is written by AI assistants: leaked secrets, hallucinated dependencies and missing authorisation checks. Plus a pre-merge guardrail set that catches them without slowing engineers down.
Active
A vendor-neutral catalogue of controls for agents that call tools through the Model Context Protocol. It covers tool poisoning, confused-deputy access, weak server authentication and over-privileged credentials, organised by where each control sits in the life of a tool call.
Active
A practical method for threat modelling anything built on a language model, from a single chat feature to agents that plan, call tools and keep memory. It combines STRIDE, CSA's MAESTRO layers and the OWASP Top 10 for Agentic Applications into one worksheet a product team can actually run.
