BRIEF Look at open-source AI security tools we can run safely on secdesk01, and decide whether any are worth adopting. DESCRIPTION Our scanners only catch what they have a pattern for. That means noise we have to sift through, and logic flaws they miss entirely. AI tools can reason about what they're seeing instead of just pattern-matching. This ticket is about finding out whether that helps us — using open-source tools we run ourselves, so our code and findings never leave our environment. Two things to investigate, both run sandboxed against Juice Shop on secdesk01: 1. Offensive — AI agents that test like a person would. They drive a terminal or browser, chain steps together, and find flaws that need context to spot. Because they send real attack traffic, they must be locked in with no route off the VM. Tools to look at: PentAGI, Strix, PentestGPT, Nebula, CAI. 2. Guardrails — the fencing that makes the above safe. Limits on what an agent is allowed to touch, blocking o...
Comments
Post a Comment