https://samarthya.me/categories/vision/Recent content in Vision on SamarthyaHugo -- gohugo.ioen© Samarthya 2018-2026. All rights reserved.Tue, 27 Oct 2026 20:32:15 -0400https://samarthya.me/posts/ssdlc-in-the-age-of-ai-exploits/Tue, 27 Oct 2026 20:32:15 -0400https://samarthya.me/posts/ssdlc-in-the-age-of-ai-exploits/<div class="lead text-neutral-500 dark:text-neutral-400 !mb-9 text-xl"> A fire inspection once a year works when fires are rare. When sparks are falling every day, you need smoke detectors in every room, a sprinkler that fixes the small ones by itself, and a person who decides what to do about the big ones. That is what a secure development life cycle has to become. </div> <p>These are my notes for a question I keep coming back to: <strong>how do you keep shipping software when new vulnerabilities arrive faster than you can fix them, and attackers can use an LLM to turn a CVE description into a working exploit?</strong> There is no single standard answer. What follows is the concept I would build, with the evidence behind each choice and the parts where I am still unsure.</p>