Primary pillar
AI Security
I build and evaluate AI security systems with one practical question in mind: can the system safely do useful security work, show its evidence, and help teams make better decisions without turning a confident summary into a false sense of safety?
What I Work On
My AI security work sits where cloud security, application security, incident response, and agentic systems meet.
Measurement for security agents
I build evaluation systems for AI agents used in security work: red-team agents, synthetic and production-like environments, benchmark tasks, scoring rubrics, and failure analysis. The goal is to measure whether an agent can reason over evidence, use tools appropriately, and produce results that hold up under end-to-end review.
Control surfaces for agentic systems
I work on the control surfaces around AI agents: tool permissions, evidence trails, action boundaries, observability, and human review. The goal is to make agent behavior measurable, constrained, and useful inside real security workflows.
Security for AI-assisted building
AI makes it easier to move fast, but it also makes old mistakes easier to repeat at scale. I use author-time guardrails and build-time verification to keep controls close to where builders already work.
Current focus
Production AI security investigation agent
I led development of the AI-powered investigation capabilities for AWS Security Incident Response, AWS’s first customer-facing AI security agent. The job is not to replace responders. It is to reduce the time spent collecting and correlating evidence, while keeping the investigation transparent, auditable, and reviewable by security teams.
Adversarial evaluation
AWS Continuum for code vulnerabilities
I built red-team agents and led end-to-end evaluation for AWS Continuum for code vulnerabilities. The work uses synthetic, production-like applications to test vulnerability discovery, exploit validation, remediation quality, safety, and regressions in repeatable environments.
Evaluation Matters
Security agents need to be measured on evidence, not just fluent answers.
SIR-Bench
SIR-Bench is a benchmark for evaluating investigation depth in security incident response agents. It looks beyond whether an agent reaches the right triage decision and asks whether the agent actually discovered new evidence, used tools appropriately, and performed real investigative work instead of repeating the alert back in cleaner language.
Accuracy is not enough
A security agent can produce a correct-looking answer for the wrong reason. In incident response, that gap matters. Good evaluations should reward concrete findings, sourceable evidence, useful uncertainty, and escalation paths when the agent does not have enough information.
Projects
A few public projects that reflect how I approach AI security: build, measure, test, and keep the claims grounded.
AI Leak Watch
A public dashboard tracking potentially exposed AI provider keys on GitHub. It started from a simple question: if AI agents are getting access to more tools and data, why are we still treating leaked model provider keys like a small billing problem?
ThreatForest
A multi-agent system that analyzes source repositories, generates attack trees, maps attack steps across pluggable adversary frameworks, and synthesizes evidence-based mitigations. The research also isolates TTP mapping as the dominant accuracy bottleneck.
Automated Security Helper
ASH brings security scanning closer to local development and CI/CD workflows. For AI-assisted development, that matters: the faster code is produced, the more important it becomes to catch secrets, vulnerable dependencies, and risky infrastructure patterns before they spread.
How I Think About AI Security
The useful work is usually less glamorous than the headlines, and that is fine.
Define the job before judging the model
For a security agent, “good” depends on the task. Triage, evidence collection, exploitability review, code scanning, threat modeling, and executive summarization all need different success criteria.
Make evidence visible
Security work should leave a trail. If an agent claims a credential was used, a role was created, or a repository is affected, the next question is simple: where is the evidence?
Treat context as hostile until proven otherwise
Documents, tickets, READMEs, logs, and retrieved snippets can all carry misleading or hostile context. Agent security starts with separating data from authority and making the system’s reasoning path reviewable.
Design for human handoff
The best security automation gives responders a clearer starting point. It should preserve uncertainty, explain limitations, and make it easy for a human to take over when the case requires judgment.
Related Reading
Start here if you want the broader context behind the projects and research.
It’s 2025. Why Are We Still Pushing API Keys to GitHub?
Why hardcoded AI API keys keep showing up in public repositories, why agentic systems raise the blast radius, and what teams can do about it.
Balancing speed and safety
A practical control framework spanning steering, specifications, scoped tool access, security scanning, pipeline gates, and risk-based human review.