Insecure Agents — Episode 8: John Sotiropoulos, Co-Lead of OWASP ASI and Head of AI Security at Kainos
Podcast: https://insecureagents.com
Listen: https://podcasters.spotify.com/pod/show/insecure-agents/episodes/Ep--8-John-Sotiropoulos--Co-Lead-of-OWASP-ASI-and-Head-of-AI-Security-at-Kainos-e364m5m
Transcript (auto-generated, lightly edited for clarity).

Allie Howe: Hey everyone, welcome to episode 8 of the Insecure Agents podcast. I'm your host Allie Howe, and today we have John Sotiropoulos to talk about the upcoming OWASP Agentic Top 10. John, would you like to introduce yourself?

John Sotiropoulos: Hi, Allie. Thanks for having me. Today. I'm joined with a difficult center in Sotiropoulos. I work as the head of AI security for a UK company called Kainos, one of the top ten AI solution providers, part of the Board of Directors for the OWASP security project. And as part of that, I co-lead the agentic security initiative for the world of great people. Like I let you promote awareness and security character. I do lots of stuff because I believe in the power community. So I write books, I've written the Adversarial AI book and I have written guidelines for the UK government.

Allie Howe: I've gotten to read part of your book as well. It's fantastic resource. Like how it's really hands on. It's got examples of you can actually pull out your laptop, start messing around with models and try different attacks and things. We're looking for a great hands on resource to learn about AI security. Definitely recommend John's book. Would love to hear more about the OWASP Agentic Security Initiative for our listeners that maybe are unfamiliar or don't know much about it. What is ASI? What is the work that we're doing there?

John Sotiropoulos: I think a little bit of context here. We actually know the top 10 for LLM applications has become the de facto standard. And so while we're doing the second edition, the 25 edition of top 10 for LLM, we've had this long conversations about Agentic. Do we have an entry on the top ten? Do we create our own top 10 for Agentic? And we thought, well, no, let's understand the space and then decide how to advise and how to support our community or build this and, and defend this. And so the Agentic Security Initiative is a group of people within the GenAI security project. And we have been looking at creating a taxonomy, I mean, which is the agentic AI and mitigations.

And you know, the idea is very simple. But yes, of course there is the space for research papers, there is the space for of leadership pieces. The end of the day, people could build the agentic applications we want them to be with specific, concrete examples. You guys are creating now a very cool application called Finbot. You're using it in Defcon, right?

Allie Howe: Yeah, super excited to show Finbot at Defcon.

John Sotiropoulos: So that's that's the kind of what we're trying to do like frame the conversation. So in fact we are completing now what I call a phase of exploration of six months. So we released also guide of how to do threat modeling. We're releasing this week a document on what security taxes look like, what secure development and deployment looks like. And then to complete that cycle, we're releasing the state of agentic security and governance, which talks about tools, talks about regulations and all that. And that's complete secure, like the overall guidance we wanted to give to people across the life cycle of Agentic.

Allie Howe: It's really interesting. I feel like the top 10 has been long associated with OWASP. So that's one of the things that they know us for the most, not just, you know, obviously ASI, but OWASP in general. And I remember learning about the OWASP top 10 for like web applications like way back in the day. And I think people still use that for security training. I know we have the top 10 for the LLMS, and those have been really helpful with the threats and mitigations guide, and those have been helpful in the community as well. And I think some tools, namely including Pensar, have been able to use those different threats that were outlined in the top 10 for LLMS in their products so that when they scanned different agentic systems and they find vulnerabilities, they can map those to the top 10, which is really helpful for security practitioners to understand what they're vulnerable to.

Why do we need an agentic top 10 typically instead of just using the top 10 for LLMS?

John Sotiropoulos: That's a good question there, Alice. So I think they're not separate. So Agentic expands on the top 10 for LLMS. We have the excessive agency. If you look at LLM application, generative AI, they occupy A broader space, A broader category. And so you have multi agency, you have things like tool abuse things that we could package them within at the top 10 for LLM, but I think it wouldn't allow us the space to articulate them better to expand on some of the things that defenders and builders require to secure applications and and understand those various vulnerabilities. So we could, yes, of course we could have kept it like we did in 2025 after the excessive agency, maybe we could have annotated all the other threats we have there or vulnerabilities we have there.

But again, you know, would have missed this wave that's happening today, their key characteristics of quite agentic applications and developments look like and I think those nuances would have been lost if we just contrasted in the top 10 for LLMS.

Allie Howe: I think too, for people that are building agentic systems and are going to use the agentic top 10 as a resource, they should also look at the top 10 for LLMS also because agents are using LLMS under the hood. So it all matters. It's all connected like you're saying. Are you able to share any of the top ten with us today? Or a sneak peak or or no, that's OK if not.

John Sotiropoulos: I will avoid that and I think I will tell you, you know what's happening. We are a community of people that puts defend this and build this and the audiences fast. We don't release something to satisfy that we've written something clever. We want something that will enable people to build robust, safe and trusted applications. And that means actually I would reference the OWASP top 10 for API, the LLM, you know, anything that actually brings people complete actionable advice. Our restaurants. I'm very, very excited to announce that on August 6th, we'll do this global kickoff where we will present the trust for the community. You start watching and providing us feedback.

It will be a public consultation that will take a few months and then we'll release the top 10 to the world.

Allie Howe: Yeah, I definitely really want to applaud your work for getting the community involved not only in these events, but the voting of the top 10, getting distinguished experts involved. We take a lot of care and a lot of time to make sure what we're releasing is actionable and it's helpful. Like you said, we're open to feedback over time. This is a, you know, a living document. It can change. Obviously, AI is changing very quickly. Amazing that we've been able to go out into the community, get feedback, and then change the resources with that feedback.

John Sotiropoulos: We will use the word community. I think you can treat the community as an audience where you've written all your clever stuff and say look at this, it's really nice to use it. Or it's something that organically involves people with their own experiences. And that's really key for us in two different ways. They were making them part of the journey. So by the time we have something, people have discussed it, have engaged, so we don't have to do any enablement. It's part of the collective consciousness of the community. The other one is it doesn't matter how clever and educated and highly sophisticated and expertise, they will not have the context of everyday experience that many of us bring who would never release anything without experts diligence.

In fact, we have a fantastic distinguished expert board from the coastal Vasilia, from Hiram Anderson, from Robust Intelligence and Cisco and people from Microsoft, the chief architect of data and cloud, the Electric Institute in the UK so quickly kind of a select people of expertise. So that's the expert back, but it's for first and foremost community driven. So it's really, really important that we bring that balancing act, and that's what we're trying to do with the top 10.

Allie Howe: Obviously you've had a very successful career in AI and security. What's your advice for teams just starting their AI security journey today? Can the agentic Top 10 be a good starting place for those teams?

John Sotiropoulos: Absolutely. I think always, it's always a good way to stand precisely because we have that ability to bring high level concepts and abstract things that you find in papers that sometimes that don't make sense into something very practically concrete. So if you look at that top 10 for LLMS, that's a fantastic way to start. There is so much out there. It's very difficult sometimes to frame those issues. Sometimes, you know, we get like a fire hose, you know, LinkedIn, you know, this vulnerability, that vulnerability. Well, you know what, that will never stop. How do I frame the problem? And don't get too hung up on the specific vulnerability because they will be new every day.

You know, should people until yesterday were asking you prompt injection, prompt injection and then it's MCP/MCP/MCP. Also, I'm sure something different will come tomorrow.

Allie Howe: It does feel like drinking from a fire hose at times depending on what people are talking about on LinkedIn and such. It makes sense that the top 10 is a great resource that is actionable and concise and can be something that people can quickly get started with. For sure. Is the Agentic Top Ten a key resource for building trustworthy AI today?

John Sotiropoulos: Absolutely. Top 10s are headlines. They help us focus and they help us playing the conversation. So in fact, when we started the top 10 for why don't you have top 12? Why don't you have top 20? Well, and you can have any arbitrary number. That's the whole point. You have to focus. You have to say those are for the time being, those are the key items I need to focus on. You can expand, you can find and you don't forget the top tens. They're not just this, We also match them with mitigation. So you have a starting point. It's like something really easy to remember are like 50 odd pages that people will forget.

Allie Howe: Yes, that makes sense. And I think the agentic top ten too can be a great gateway to other OS resources. So if you're wondering, OK, like there's these top ten, you know, things that I should be worried about. But based on my architecture or based on the way that I have my agentic system set up, whether it's a multi system architecture or rag setup or a single agent set up, what should I word out the most? And then they can turn to the threats in the mitigations guide or other resources to understand these in more detail. And then just to circle back to the community piece here for a second, I've noticed companies like SAP have been able to incorporate the OWASP threats and mitigation guide into their strategy.

And I've also seen security companies that are creating products to scan agentic systems such as Pensar, Splix, AI and AI and E, They've all been able to adopt our work into their products. So what's next for OWASP ASI?

John Sotiropoulos: You're asking me difficult questions now. First of all, I really like how you framed it by taking the threats and mitigations and moving to top ten. We are sparing people from research people in the space very often create new things and then not worrying about you know how people are going to adjust and we need to be a little bit more cognizant of that of the usability issue that has of you know the practitioner. So by starting with the threatening mitigations that the reception has been some Chernobyl and fantastic. Even so, SAP, Kainos is using it, the national healthcare application in the UK where we talking about introducing a, a features we're using again the threats and mitigation.

So, you know, these are kind of adoption stories of phenomena in support of the the government's contracts here, creating some supplemental implementation guides like the one I wrote at the beginning. And that again will reference threat mitigation top 10. So I think that's the direction we're going to move. We're going to keep an eye on what's new and research. And then I know Ron isn't here and Ron is really, really keen on the research and we've done some great research actually, you know, some very, very clean people like Ken Huang, Venice, Eden and Academy back where there all the agentic naming services will want to take this further.

So we'll keep keeping an eye on what's coming up and bringing it to the fore. But really, what we want to focus once the top 10 is out, how do we make this embedded into people's lives? Because that's the purpose, right? It isn't just to see my name on a piece of paper. It's to make sure that people in everyday life use the agentic security initiative. And then what we'll do is we'll have a nice consultation to the top 10 for all of us involved, like we did in RSA. But adoption, adoption, adoption and practical use are the kitchens.

Allie Howe: Yes, I think that's key as well. Practical use is super important because I've heard from people that I've talked to that are navigating their AI security governance strategy for the first time and they're thinking, Oh my gosh, like there's so many frameworks out there, so many resources, and they're feel like they're drinking from a fire hose. Especially because some of the table stakes required frameworks such as SoC 2, for example, that doesn't have anything about AI security in it. So they go looking for other frameworks to bring on, but none of these are required. So they could choose from any of them, which makes it difficult because there's so many to choose from.

But I think the ones that are actionable resources are the ones that are going to stick around over time is the most helpful.

John Sotiropoulos: And I think you raised a very good point there. I think sometimes when we write those frameworks and guidelines, our obsession and our keyword is to be complete. Some of the conversations we had, I'm sure you remember them. It's like, oh, you know, what about this, what about that? Well, for sure, but you know, we're not going to be the encyclopedia of threats and mitigations. What we want is something, even if it misses a few points, that will help people understand the secure and application. In fact, you know, for the code of practice, you will see it on LinkedIn. I'll publish it for free. I have created a very simplified AI threat navigator that when I reviewed with this is how this is so simple.

And then I reviewed with practitioners and I said, oh, fantastic, I can understand how to use. So we in the community need to learn that maybe we don't need to be scientifically the best, maybe we'll have that essence somewhere, but do we need to find the language and the way to make this simplified and concrete? And I think that's what you were referring to.

Allie Howe: Yes, simple is best for sure so people can actually get started, especially if they're just starting their AI security journey. That needs to be actual. Needs to be simple, doesn't need to be overkill.

John Sotiropoulos: This is where you're, this is your kind of works in the just phenomenal and fantastic. We're aiming at developers and what I'd say we have a an example for every threat that we have in the investigation.

Allie Howe: Yeah, I think if not super close, I mean, I think we've got like, what is it 16 different threats? If we're missing one, it's maybe like one or two.

John Sotiropoulos: Well, that's fantastic. And I challenge anyone who has written all those massive frameworks to show us how that would happen in practice. Because sometimes, you know, you read all these kind of things and they say, oh, you need to do that. And then I think, how can someone please show me? And I think that's, that's where we need to move towards. It's at concreteness of this is how you do things.

Allie Howe: That's kind of the whole idea around Finbot, the vulnerable application that Helen and I are creating to show at Defcon. It's this application builds on Mastra, which is one of the leading TypeScript AI agent frameworks, and it was actually kind of hard to get it to show an example of memory poisoning. We had to use other threats in conjunction in order to get the agent to take an action, and it wasn't supposed to.

John Sotiropoulos: In practice, things are different. And that's a fantastic point there. When I was writing my book, the Adversarial AI, I was telling someone about threats that they shouldn't be worried that much. So I tried to do model inversion for weeks and weeks and it was extremely difficult. So, you know, there are things that of course we need to be aware and of course we need to understand the concept, but let's try and provide some very concrete examples of how that would happen so people understand how to intimidate, how to secure it, and how to assurance.

Allie Howe: That's helpful too, because in security in general, risk is all about the likelihood of the risk occurring times the impact. Because it's not likely to happen, then maybe we don't focus our energy and time on it, especially if we're a small startup and there's so much for us to do, we can't tackle every single threat.

John Sotiropoulos: And I listen just about startups. This is an asymmetrical game. If you look at how adversaries and research produces new threats of a bucket load. If we try to do everything, then we wouldn't do anything, right? And what we'll do is we'll end up demoralized and not securing everything. So we've got to put, you know, people talk about field shortages, they talk about how they're so busy all the time. You know, they're when I talk to cyber teams, the favorite expression that they throw at me is drowning. And you're showing me the water. In other words, so much to do. There is a new cyber resilience act here in the UK and you just go through a litany of close A, close B, threat A, threat B.

So we need to move away from that. And you're absolutely right, we need to focus on what's relevant.

Allie Howe: And cybersecurity, the work is never really done, so being able to ruthlessly prioritize what's most important is very important for teams. And I think the agentic top 10 specifically has a great Ave. to be able to be one of those resources that can help teams focus.

John Sotiropoulos: Whole series of taters that we have are designed to have that and now the top ten, it will give you that compact to say well this is where I stand and this is how I use all that. And we will discuss that on the the Global Kickoff on August the 6th.

Allie Howe: What can we expect on August the 6th?

John Sotiropoulos: So we talked about this whole principle of being expert back because we need to have that diligence. We cannot make things up, but also community driven. So what we're doing is we're going to have local events across the globe and with local always communities getting together, they need to view a discussion and they kind of intimate low key discussion. And then all of us by getting together on a global call with a distinguished expert boards that will give their insight. And then as they handle over to you guys and Las Vegas where you're doing the Black Hat. And I'm very jealous about that. I've said that I won't be there, but to carry on the discussion and that will that will bring such a diverse range of people across the globe to highlight that essence of our community that we're very inclusive, cross different cultures and different nationalities, supported by the best minds of our excellent review board and then kick off the conversation and it will be an exciting conversation to have.

Allie Howe: Looking forward to that conversation and looking forward to the events at Blackhat for sure. Is there anything else we didn't cover that you'd like to talk about today?

John Sotiropoulos: My message to everyone is this AI accelerates much, much faster than any of us can do. So let's be very deliberate about what we do. Yes, there is space for vendors to create super tutor projects and products. Yes, there is a space for top leaders and researchers. But really, really the key priority is how do we bring this into action? And there is no better place for me to bring that action done, almost particularly the Agentic Security project and ASI.

Allie Howe: Amazing. Thank you so much for your time today. And I look forward to continuing working together within ASI and I'm looking forward to the release of the agentic Top 10 where we can people find you if they want to continue the conversation.

John Sotiropoulos: LinkedIn is the place where we all like aggregate. Come to Slack. You're watching this really, really great people. And you, Helen Rochrone, Danny, I'm going to miss names. I don't want to do that, Karen. So many great people that push the envelope, you know, kind of making it so finally LinkedIn, come to Slack and talk to us.

Allie Howe: Definitely echo that it's a great group of people and we'd love to see you in Slack, so please join. That's it for episode 8 of the Insecure Agents podcast with John Sotiropoulos, Co lead of the OWASP Agentic Security Initiative and head of AI Security for Kainos. We'll see you next time.