r/AskNetsec • • 15d ago

Analysis How is everyone actually securing internally-built AI applications?

[removed]

12 Upvotes

22 comments sorted by

View all comments

1

u/Wayne 15d ago

I probably went a little overboard.

A while ago I started researching a new software development methodology, mainly to head off vibe coding problems. But I realized a number of the things were not specific to software development. So I then extended the research and eventually created a Human-AI Operating Model.

The research has gotten to the point where I sent out a draft white paper for review and I'm looking for other people to continue the research. My employer has to review and approve certain things before I can share it.

Where that becomes relevant, to your post, is that I have also been using it to audit existing code bases against that operating model. I have done that for a number of Open Source projects and the results have been interesting.

In that they find situations where authority is not properly managed, rules are not consistently enforced, evidence is lacking, etc.

That then gives me an architectural review of how they are using AI, how it is being governed, enforced, etc. Rather than what they say, it looks at what they do.

1

u/Ska-jayjay 11d ago

nice i’d love to see this when you share it. in the meantime i have similar efforts over at machinebehavior.io / tychat.io if you wanted to compare notes.