Head of Threat Research · Agentic AI Security & Decision-Rights · AI SOC + OT/ICS · SecOps · Board Member
Working on the architectural floor for AI agents that take irreversible actions. The thesis in one line: investigation is reversible, actuation is not — and the gate for the write side has to be code the agent cannot reach, evaluating a manifest the agent cannot rewrite.
Three primitives carry the architecture:
manifest.action_class = "irreversible" // declared upstream by publisher
deterministic.gate = outside_loop // code the agent cannot reach
worst_case.chain_rule = governs_chain // composed actions inherit the worst class
Twelve-plus years across threat research, AI-driven SOC detection and response, OT/ICS security, cyber-range exercise design, cyber-crime investigation, and web/mobile/application security.
| Project | Status | Scope |
|---|---|---|
| OWASP AISVS |  |
Named in the published v1.0 contributor list. Reversibility-graded action controls in C09: C9.2.3 (reversibility classification), C9.2.4 (enforce by class), C9.2.10 (worst-case reachable across chains) |
| OWASP SPVS |  |
V5.6.5 IR decision-rights (PR #14), V1.3.7 NHI runtime decision-rights (PR #15), supply-chain (Issue #13) |
| OWASP Cornucopia (Agentic AI) |  |
Per-action-class decision-rights and reversibility mapping into the AAI suit (Issue #3018, merged in PR #3233). Listed on the project tribute page |
| OWASP GenAI Security Project | |
Reversibility-graded authority into Agentic AI Threats & Mitigations v1.1 (Issue #13) |
| OWASP Agentic Skills Top 10 (AST09) |  |
Cross-execution chain linkage (parent_action_ref + fan-in) accepted into the AST09 execution-receipt proposal (Issue #44) |
| Creduent (open agent identity standard) | |
Reversibility classification in the signed Execution Receipt schema: design-time conformance gate plus runtime fail-closed on unclassified tools, anchored to AISVS C9.2.3 (PR #8) |
| Agent Evidence Levels (AEL) | |
Governability extension: reversibility-class provenance on evidence records, fail-closed on unclassified or unverifiable policy (PR #2) |
| Microsoft Agent Governance Toolkit | |
India regulatory policy pack as Rego policy-as-code: DPDP, CERT-In, RBI, SEBI, Aadhaar (PR #3123, 12 files) |
| OWASP Agent Control Standard |  |
Tool declarations carry no integrity binding, so a same-version redefinition is invisible to Inspect-Dynamic (Issue #38). Deferred to the v0.2.0 window; named in the project's Strategic Adoption Plan as the strongest technical contribution received from outside |
| CSA NHI v1.0 |  |
Peer review June 2026 |
Prior OWASP leadership: AppSec India Co-Leader (2016–2020) · OWASP Indore Chapter Leader (2017–2018)
|
Independent, vendor-neutral conformance scenarios for the action-class and reversibility controls in OWASP AISVS C09. Real-data fixtures generated from a published MCP registry corpus, three binding states in the record against two outcomes at the gate, and a supersession event channel so an implementation cannot pass every scenario while emitting nothing. Cited as the executable form of the argument in 10.5281/zenodo.22649163. |
Reference implementation of OWASP AISVS C9.2.3 / C9.2.4 / C9.2.10: reversibility classification, enforce-by-class gate, worst-case reachable across chains. JSON schema + Python. |
|
NHI runtime decision-rights companion to OWASP SPVS V1.3.7. Identity provenance verification, token freshness, action-class authorization. |
Research lens cross-walking agentic AI standards across CSA, NIST, OWASP and others, mapping where the same control is named differently and where a control exists in one body and nowhere else. |
The full architectural reference. 18 chapters across 5 parts (Problem / Architecture / Standards Anchor / Applied Patterns / Implementation) + closing. Develops the four-class reversibility taxonomy (read-only / reversible / external-reversible / irreversible), manifest-declared classification, worst-case chain rule, and the architectural floor that makes the gate resistant to prompt injection. Anchored in OWASP AISVS C9.2.3 / C9.2.4 / C9.2.10 (reversibility classification, enforce-by-class, and worst-case reachable across chains; AISVS v1.0).
Cross-substrate convergence catalog (10 substrates): OWASP AISVS · CSA IAM WG · PieterKas/agent2agent-auth-framework · SANS AI Security Maturity Model · CSA AARM · Identient AuthR · Digital Identity Forum · CSA NHI · James A Bex AI Engineering Handbook · Riddhi Mohan Sharma EHV.
Long-form essays on AI agent security, decision-rights, reversibility-graded authority, and contribution methodology. Three essays published June 2026 (~9,900 words + 7 figures):
- The Decision-Rights Plane: An Architectural Gap in AI Security — the missing primitive at layers 4 and 5
- Investigation Is Reversible. Actuation Is Not. — the read/write architectural fold as design primitive
- What I Learned Contributing Across Five Standards Surfaces — the cross-surface contributor method
- Action-Class Authority When AI Agents Do the Triage — eForensics Magazine, AI in Forensics: The Age of Autonomy (Jun 2026)
- Interview with Mayur Agnihotri — Science Of Cyber Security (Oct 2017)
- Conviction Of Digital Crime — National Cyber Defence eMagazine (Aug 2016)
- PenTest: Penetration Testing in Linux — PenTest Magazine (Mar 2016)
- PowerShell For Penetration Testing — PenTest Magazine (Jan 2016)
- Predictions For Cyber Security in 2016 — eForensics and Hakin9 (Dec 2015)
CVE-2026-90572 — memory corruption in TSnap7MicroClient::opUpload, snap7 1.4.0 to 1.4.3, the Siemens S7 client library vendored by a good deal of SCADA and HMI code. A length field the server declares, copied without checking it against what actually arrived. Credited as finder on the CVE record. Published 13 September 2026, CVSS v4.0 5.1, v3.1 4.7.
GHSA-wcqx-x7x9-c8rm — out-of-bounds read in the libiec61850 IEC 61850-9-2 Sampled Values subscriber, via a missing APDU-length check in parseSVPayload(). Unauthenticated and network-adjacent; crashes the SV receiver. Credited as reporter. Published 13 August 2026, CWE-125, CVSS 3.1 base 4.3. Fixed in v1.6.2 with the one-line length guard proposed in the report.
LDAP server flaw research (Red Hat) and web-application vulnerability disclosures across major brands.
| Role | Org | Period |
|---|---|---|
| Head of Threat Research | StraightArc Technologies | 2026 to present |
| Information Security Specialist | StraightArc Technologies | 2020 to present |
| Head of Threat Research | SecSphere SOC | 2020 to present |
| Board Member | SkyVirt | 2017 to present |
| Senior Subject Matter Expert | TCS iON | 2022 to present |
| Board of Studies | Ramachandra College of Engineering | 2023 to present |
| CHFI Item Writer | EC-Council | 2016 to present |
| Director | ARNE Solutions | 2016 to present |
| Technical Committee | Digital 4n6 Journal | 2016 to 2018 |
| Team Member | National Cyber Defence Research Centre | 2016 to 2018 |
📍 Udaipur, India · ⏱ GMT+05:30
Vendor-neutral standards work. Decision-rights for AI agents, reversibility as the architectural floor, manifest-declared action class as the standards-side answer.