Repello AI reposted this
📣📣📣 The Boring AppSec Podcast Ep. 28: The Attacker's Perspective on AI Security with Aryaman Behera (Co-Founder and CEO @ Repello AI) is out now! In this episode, Aryaman shares his unique journey from being a bug bounty hunter and the captain of India's top-ranked CTF team, InfoSec IITR, to becoming the CEO of an AI security startup. The discussion offers a deep dive into the attacker-centric mindset required to secure modern AI applications, which are fundamentally probabilistic and differ greatly from traditional deterministic software. Aryaman explains the technical details behind Repello's platform, which combines automated red teaming (Artemis) with adaptive guardrails (Argus) to create a continuous security feedback loop. The conversation explores the nuanced differences between AI safety and security, the critical role of threat modeling for agentic workflows, and the complex challenges of responsible disclosure for non-deterministic vulnerabilities. In the clip below, Aryaman explains how organizations can use Repello's open source tool "Agent Wiz" (https://lnkd.in/dKMbg-py) to generate a threat model of agentic workflows in AI applications. They can then upload that threat model to Repello's platform which will perform a red team against those AI applications, without Repello having access to the organizations code. This makes sense because LLM inference calls, specially with SOTA models can get expensive real fast and with the non-deterministic nature of AI apps, red teaming them with a black box approach might require sending a large number of requests to build a "consensus" amongst the outcome of those requests. This would ultimately make red teaming AI apps, a very expensive activity. So, if orgs are comfortable sharing their blueprint of AI applications (almost like ground truth used for testing AI models), it saves everyone time, effort and $$ to detect real impactful vulnerabilities. This episode has a lot of good content on AI red teaming so if you are currently exploring this space, I'd highly recommend giving it a listen. Links will be in comments! cc: Sandesh Mysore Anand #appsec #ai #llm #security #softwaresecurity #redteam #theboringappsecpodcast #cybersecurity #securityforai PS - The same approach could even be applied to non-AI applications. The OWASP Threat Model Library (https://lnkd.in/dfDadp_z) launched recently. I am not sure if this exists already but we need a tool/agent that can read source code and build threat models adhering to the threat model schema of this project. Is there anything for this already? If not, this seems like a good weekend project! If you're interested in building this with me, lets collaborate! Feel free to drop a message below.