AI Security Lab

The work, not just the outcome.

A working portfolio of AI-security, application-security, DevSecOps, training, and research projects — each with the problem, the approach, the tools, and what I took away. Items are labeled honestly: in progress, research, or published.

Abstract threat-model graph of interconnected nodes

AI Security In progress

Promptfoo AI red team CI/CD pipeline

Problem: LLM features ship without repeatable adversarial testing, so prompt-injection and unsafe tool-use regressions slip into production.
Approach: Wire Promptfoo red-team suites into GitHub Actions so every change runs LLM attack scenarios and fails the build on critical findings.
What I learned: Treating LLM tests as gated CI jobs — not ad hoc notebooks — is what makes AI-security testing actually repeatable.

Promptfoo GitHub Actions OWASP LLM Top 10 MITRE ATLAS

GitHub Write-up

Research Notes In progress

OWASP LLM Top 10 security notes

Problem: The OWASP LLM Top 10 is written for security readers; product teams need it in their own language.
Approach: Translate each risk into a builder-facing note: what it looks like in a real feature, how to test for it, and the control that mitigates it.
What I learned: Most LLM risk is a familiar engineering problem — input trust, authorization, and output handling — wearing a new name.

OWASP LLM Top 10 MITRE ATLAS

Write-up

AI Security Research

AI red teaming lab journal

Problem: AI red teaming is easy to talk about and hard to do well without deliberate, documented reps.
Approach: Run structured prompt-injection and jailbreak exercises, then publish the methodology, payloads, and outcomes as a running journal.
What I learned: Documenting failed attempts is as valuable as the successful ones — it maps the real boundary of a model's controls.

Gandalf HackAPrompt Garak PyRIT

Journal GitHub

Application Security In progress

API-to-LLM attack methodology

Problem: Teams treat LLM security as a brand-new discipline, missing that API pentesters already hold most of the relevant skills.
Approach: Map traditional API security testing onto LLM attack paths using PortSwigger labs and Burp Suite workflows, with OWASP mappings throughout.
What I learned: The fastest route into AI security for an AppSec engineer is the API surface they already know how to break.

Burp Suite PortSwigger Web Security Academy DAST

Write-up GitHub

Research Notes Research

PortSwigger LLM lab notes

Problem: Lab exercises are valuable but fade quickly without distilled, reusable notes.
Approach: Work through the PortSwigger LLM attack labs and capture the technique, the underlying weakness, and the defensive takeaway for each.
What I learned: Indirect prompt injection through tool integrations is consistently the most underestimated LLM risk.

PortSwigger Web Security Academy Burp Suite OWASP LLM Top 10

Notes

DevSecOps In progress

Secure AI threat modeling templates

Problem: Teams adopting AI features rarely threat model them before build, so risk is discovered late.
Approach: Build reusable threat-modeling templates for AI features — data flows, trust boundaries, tool/agent permissions, and abuse cases.
What I learned: A lightweight, AI-specific template gets used; a heavyweight generic one gets skipped.

MITRE ATLAS OWASP LLM Top 10 Threat modeling

Templates GitHub

Training Published

Mobile app security with mobile DevSecOps

Problem: Mobile apps are high-value targets, but practical, delivery-focused security training is scarce.
Approach: Author a hands-on EC-Council course covering mobile security testing and secure delivery practices, with practical demos.
What I learned: Engineers retain security practices far better when they're taught inside the delivery workflow, not as a separate audit step.

Mobile DevSecOps SAST SCA DAST

Video Course

Want to dig into any of this?

Happy to walk through the methodology, the testing, or how it maps to your stack. Reach out and let's talk specifics.

Get in touch LinkedIn GitHub