Include Security

Latio Tech List version 1.16 is live! Here are the changes: 1. Added Traceable to API security and ADR. When talking to the "networky" API Security providers, Traceable always comes up as the scary guy in the room, and now I understand why. They started with the hard stuff (tracing) and backfilled the easy stuff (network logs) and showed some examples that were truly innovative in helping teams research and respond to events like fraud detection. The hard part is just assessing how integrated you need to be to see some of that stuff - but either way they're incredibly well positioned for the future of the market. 2. Added Include Security to pentest. Pentests are a hard category for me to evaluate, so I mostly have to go on public research information to get a sense of how in depth certain providers go. Include gives a lot of confidence in their technical ability for a pentest aimed at real security rather than check the box. 3. Added NightVision to DAST and API Security - scans you code, builds API docs based on the code, then scans your APIs from the outside 4. Added Kloudle to CSPM - a simple on demand CSPM scanning tool, unique for its ability to scan Digital Ocean.

An epic tale of AI security woes! Learn more about Consumer Reports collaboration with Include Security and the brilliant Abraham Kang, Esq. diving deep into LLM application security risks with python code interpreters #techatCR #innovationatCR

Edit: We're glad everybody enjoyed our April fool's joke for 2024. See you can be serious about security but also have fun! ---------------------------------------------------------------------------- We released our new semgrep rules today. Given the recent news about executive orders from the Whitehouse, we thought it would be important to flag all of the code that doesn't meet federal standards. Memory Safety is no joke folks:

Thanks to Include Security LLC for Sponsoring #OST2 at the Bronze🥉 level! More about them here: https://lnkd.in/eXh9CQrQ

Hey Linkedin crew, we just published a new research blog post on some offensive Ruby exploit techniques! It's always exciting to find a deserialization functions accepting user input, but what’s your plan if well-known gadget chains aren’t an option for exploitation? In this post, our consulting team explores the process of building a custom gadget chain to exploit deserialization vulnerabilities in Ruby. 😁 https://lnkd.in/ejRnpJsG

Today we're dropping the start of a new blog series on a different look at AI/ML security and thinking about prompt injection then what you may have seen in the past. Here's the first post in the series if you're new to this stuff make sure to read it, if you're old hat AI/MLsec then the next post is gonna be more to your liking! Intro.... Many developers are leveraging LLMs without taking advantage of system roles, making their applications vulnerable by design. Security researches may be missing severe issues with prompt design and implementation by not testing the LLM APIs and focusing on the web user interfaces of LLM providers. Our latest blog post provides prescriptive advice to LLM application developers to help them minimize the security risk of their applications. It also helps security researchers focus on the issues that are important to developers of LLM applications. This post is the first in a series of two, where in future posts we’ll cover the concept of attention in transformer models.