AI applications, models, code security, vulnerability detection, and AI-powered SAST/DAST.
Stand up the AI/HAI Software Assurance program, inventory everything the organization ships with AI in it, and baseline the metrics that prove shadow AI in engineering is decreasing.
Explore →Publish the priority compliance map and the minimum policy stack governing AI/HAI software the organization ships, so every obligation reaches a named policy and a named owner.
Explore →Give engineers who build and ship AI features the role-based AI security literacy and the practical guidance they need to make safe decisions without asking, in the Software domain.
Explore →Publish an archetype-level threat library for the Software domain, tagged to the HAI TTPs and MITRE ATLAS, so threat modelling starts from a reusable baseline rather than a blank page.
Explore →Publish a base security requirements pack per software archetype, every requirement carrying a testable acceptance criterion, so teams inherit requirements rather than negotiating them.
Explore →Publish reference architecture patterns and an antipattern catalogue for each software archetype, so the secure design is the default path rather than an achievement.
Explore →Establish a two-lane design review for software AI changes with a published checklist and service level, so review is predictable enough that teams route through it.
Explore →Review what was actually built against what was designed and required for software AI assets, at go-live, with findings tracked to closure.
Explore →Baseline a foundational security test battery per software archetype that asserts the controls actually hold, and run it before every release.
Explore →Run one backlog for software AI issues with an AI-aware severity taxonomy and published service levels, so AI findings age and escalate like everything else.
Explore →Publish and apply a hardening baseline for each software AI archetype, so the operating environment enforces the controls rather than documenting them.
Explore →Establish a logging baseline per software archetype and a detection set covering the top threats, with retention set by the longest applicable obligation.
Explore →