Hi, I'm Kishore Kumar

I do not treat AI as autocomplete. Every project I build with AI assistance carries a canonical context set — an instructions file defining the domain model and security constraints, org-wide coding guidelines, and a decisions log. The rule is simple: no code is written until that context has been read, security is stated as the primary design constraint rather than an afterthought, and nothing reaches a protected branch without human review. It turns an unpredictable tool into a repeatable one.

Security tools produce raw output; leadership needs decisions. I build the layer in between. Scanner JSON becomes an executive report with severity breakdowns and CVSS context. SIEM alerts become tracked Jira tickets with owners and SLAs. Findings scattered across several products become the Argus Security Dashboard — one place to see posture, correlate causes and act, behind SAML SSO and role-based access.

AI compresses the slow parts of security work — summarising alert context across tools, drafting policy against ISO 27001 and SOC control language, writing detection logic and turning assessments and incidents into readable reports. I use it to move faster on the analysis and documentation load, while keeping judgement, verification and sign-off human. Speed on the writing, not on the deciding.

Adopting AI is itself a risk decision. The same governance I apply to any vendor applies here — what data leaves the organization, where it lands, who approved it and what the fallback is. Secrets stay out of prompts and inside a managed store with scoped tokens and full access logging, dependency and code quality scanning runs inside the repositories themselves, and awareness training now covers AI-assisted phishing and social engineering.