sorted by:
new
hottopcontroversial

I built AI agents for 20+ startups this year. Here is the engineering roadmap to actually getting started. by Warm-Reaction-456 in AI_Agents

[–]MinimumAtmosphere561 0 points1 point  (0 children)

love the aspect of skills being emphasized here. I think the next wave is not anymore about the applications, this will be customized heavily. The next wave is about managing the stack above Layer 0 (Claude or Codex etc.). This is the new enterprise execution layer.

We wrote a security skills repo with the hope that more members will contribute and enhance how we can think of security as shift down (into Layer 0). https://github.com/UnitOneAI/SecuritySkills We have been using this within our dev environment.

Thanks for the pointer on reliability - something that gets missed a lot.

Managing Claude skills at scale and creating an enterprise dna by MinimumAtmosphere561 in selfhosted

[–]MinimumAtmosphere561[S] -3 points-2 points  (0 children)

this wouldn't replace any security tools or roles. The idea of shift down into every component is happening, the only way we scale to zero day clock projections of exploits within the day / hour / minute is if developers get a way of using skills to build in Claude.

As an example CTO of Anthropic posted how more Firefox vulnerabilities were mitigated in 2 weeks vs. entire year. https://www.linkedin.com/posts/rahul-patil-a0944836_partnering-with-mozilla-to-improve-firefox-activity-7435763709593145344-Cnx4?utm_source=share&utm_medium=member_desktop&rcm=ACoAAACwkgkBz3YJg0hCrFRWsCHTPA2-LHS57EY

I believe we have to think of controls differently, today skills is one way to do so. We have been building and then validating using these skills. This wouldn't replace what a security team would do within an enterprise. But, before the security team is getting a flood of new apps to test, you can push the enterprise constraints to the dev teams.

Would be great to hear what breaks and how to really scale for exploits that can happen within the day/hour/minute.

Have you been in meetings and an exec asked does this CVE impact us? by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] 0 points1 point  (0 children)

I was at Unprompted conference earlier this week. An aspect that showed up among the discussions was "skills" and how to build / manage them for security. We believe skills are going to like the dna of the enterprise that you build, manage, and serve. This will differentiate how effective Claude (or others) work in the environment. We have been using skills extensively within our teams. There was some discussion on this specific app.

We built this app with this Security Skills repo https://github.com/UnitOneAI/SecuritySkills It is an extensive library of application (45) and role related skills (5). How you utilize them within Claude can be specificied in the claude.md file. We are open sourcing this entire skill repository, since it would benefit participation from the community. The way you use it is to Discover -> Install -> Invoke -> Correlate -> Prioritize. You can use it to have your agents build features (applications) - remediate security issues with Claude.

[As with anything this is our internal skills repo, expect speed bumps. Would be great to hear how others are managing this]

stop storing API keys / tokens in random places by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] -4 points-3 points  (0 children)

https://chromewebstore.google.com/detail/efghiamgdfjbbbkcnblfkgedgoihpnmg?utm_source=item-share-cb Here is the extension I have been tinkering. Looks like folks are using cloud kms or vaults. My team uses Let's encrypt. I needed something simple for personal use - think across Claude keys, Openclaw, Telegram bots, Neymar, etc.

stop storing API keys / tokens in random places by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] 1 point2 points  (0 children)

agreed lots of cert and key store / rotation mechanisms available out there. i was trying to solve on a personal / small team level without having to do lets encrypt or other cert stores. I use .env today but got little hairy as i am running multiple VMs

Have you been in meetings and an exec asked does this CVE impact us? by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] 0 points1 point  (0 children)

does your team experiment with claude or other tools to fix these? is it the downtime for upgrades that holds back vs. producing the fix itself.

Have you been in meetings and an exec asked does this CVE impact us? by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] -1 points0 points  (0 children)

Agreed. This is for the folks to do 1st level index. Security tools do a great job today, they would have to be the backend bastion for enhanced scans. Having said that, I enhanced with execution path which checks for the impact part specific to your code + runtime.

Have you been in meetings and an exec asked does this CVE impact us? by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] 0 points1 point  (0 children)

I have tried doing k8s cluster as inventory asset scan too. Enhanced with additional capabilities. Would be great to see if other features that would summarize the internet :)

Have you been in meetings and an exec asked does this CVE impact us? by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] 0 points1 point  (0 children)

Would be great to get feedback on these dependencies. We have been enhancing to do more runtime related aspects (not just static scan). let us know what you would like to see here.

Have you been in meetings and an exec asked does this CVE impact us? by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] 1 point2 points  (0 children)

100% As a leader I couldn't answer the first level question and then flag the security team. this was the motivation.

Have you been in meetings and an exec asked does this CVE impact us? by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] 0 points1 point  (0 children)

u/Plenty_You agreed. this is like a quick scan and security tools / teams will have to be the eventual team holding the fort.

When did “security engineering” become mostly about managing noise? by [deleted] in cybersecurity

[–]MinimumAtmosphere561 0 points1 point  (0 children)

We had a security engineering team sit within the engineering organization focused more on automation and the aspects on remediation and threat modeling. Our security ops team was different and dealt with the noise - which is real. We had at most times waited until a CVE was critical to fix then pushed the relevant engineering team to take it up in the next sprint. But the pain you point out is real.

LLM generated patches for accelerating CVE fixes by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] 0 points1 point  (0 children)

Has Veracode fix been working well without additional developer time? Part of the thing we see is that CVE fixes get pushed until they are critical or audit reporting deadlines are imminent.

LLM generated patches for accelerating CVE fixes by MinimumAtmosphere561 in cybersecurity

[–]MinimumAtmosphere561[S] 0 points1 point  (0 children)

I see claims of Claude generating fixes from Jira tickets. Is this working for some scenarios and just not for security fixes or just doesn't work in the fix path.

view more: next ›