Stand SP04 is open. Day 1 at @GISECGlobal, Hall 1. Live demo of the labs, stickers to take away, and a straight answer on certifications and team training. Here until Thursday. #GISEC2026

Day 1 at @GISECGlobal, and the doors are open. We are at Stand SP04, Hall 1, until 17:00. Labs are running live. Ten certifications mapped to real roles, for one engineer or five hundred. Dubai Exhibition Centre, Expo City. #GISEC2026

10 certifications at @GISECGlobal, & 2 of them did not exist 18 months ago. CAISP & CMCPSE exist because agents & #MCP servers went into production faster than anyone wrote a #threatmodel for them. Stand SP04, Hall 1. exhibitors.gisec.ae/gisec-gl… #GISEC2026 #AISecurity

Three days in Dubai, and the three people you would normally email are standing in one place. @secfigo, @RajDevSecOps, and @gmaran23 are at the stand at @GISECGlobal for all of it. Labs are running live. Stand SP04, Hall 1. 16-18 Sep. exhibitors.gisec.ae/gisec-gl… #GISEC2026

Detail on the three formats and when to standardize on which: practical-devsecops.com/type…

The gap is rarely tooling. Syft and Trivy generate all three formats for free. The gap is a decision nobody's made: which format serves security, which serves legal, and whether you maintain both without duplicating effort.

SolarWinds and Log4Shell didn't fail for lack of patches. They failed because organizations couldn't answer "are we exposed" in hours instead of weeks, the exact question SBOM tooling exists to answer.

M&A due diligence is where this actually bites. Acquirers now ask for SBOM coverage across the target's product line. "We have some SPDX files somewhere" reads as immature security posture, and it gets priced into the deal.

CycloneDX, SPDX, and SWID are not interchangeable. Feed a CycloneDX SBOM into tooling built for SPDX and vulnerability metadata your AppSec team needs silently drops out.

Your procurement team files a vendor's SBOM as a PDF. That satisfies a checkbox. It does not answer the only question that matters during an incident: are we exposed, and can you prove it in under an hour.

None of this requires the model to be dumb. It requires the system around it to trust tool outputs by default, which is how almost every MCP integration works right now. More on these patterns here: practical-devsecops.com/mcp-…

Indirect prompt injection is the quiet one. The malicious instruction doesn't come from the user's prompt. It comes from a webpage, a cached file, or a ticket the agent reads as "just data."

Named attack patterns already exist for this: tool poisoning (fake tool descriptions), metadata poisoning (hidden instructions in tool docs), and MCP Preference Manipulation, where an attacker skews which tool the agent picks.

MCP servers create this trifecta by default. The agent has tool access (privileged), reads external data like tickets or web content (untrusted input), and can call other tools (the channel out).

That's not hypothetical, it's documented. It maps to a pattern security researchers call the "Lethal Trifecta": privileged access, untrusted input, and an external communication channel, all present at once.

In mid-2025, a Cursor agent connected to a Supabase MCP server processed a support ticket. The ticket contained embedded SQL instructions. The agent ran them. Tokens got exfiltrated.

Certified AI Security Professional (CAISP) is built around that same OWASP/MITRE ATLAS material, tested through adversarial exercises rather than multiple-choice recall. More detail here: practical-devsecops.com/cert…

Most candidates applying have zero hands-on experience with prompt injection testing or tools like Garak and PyRIT, the frameworks these job postings actually require.

AI/ML Security Engineer roles are posting $152K-$210K. AI Security Architect roles go up to $280K+. The hiring market already moved.

MITRE ATLAS documents real adversary tactics against ML systems: data poisoning, model extraction, evasion attacks. Most security teams have never opened the framework.