Security researcher · Agentic AI security · Post-quantum cryptography · AppSec mentor
Building the evidence base for securing AI agents and migrating the world's cryptography before Q-Day.
- I run security for 70,000 people. AppSec, DevSecOps, Infra Security, Offensive Security — ~40 engineers, five countries, at EXL. DevSecOps: manual → 98% automated, on my watch.
- Agentic AI security isn't theoretical for me. Patent-pending inventor on an autonomous vulnerability discovery-and-remediation system, now live with enterprise clients.
- Post-quantum crypto, in two languages, byte-identical. quantum-safe-py and quantum-safe-ts — same hybrid KEM/signatures, same output, Python and TypeScript.
- I publish evidence, not opinions. Benchmarks on where LLM-generated infrastructure code breaks, and where PQC migration tooling actually fails.
- I teach what I ship. Mentor at IIT Roorkee and IIT Mandi. Trained 80+ engineers on AI security and agentic coding.
Agentic AI Security · Prompt-Injection & Tool-Call Mediation · AI Agent Identity & Runtime Governance · Post-Quantum Cryptography (ML-KEM, ML-DSA, SLH-DSA) · Cryptographic Migration & Crypto-Inventory · AI-Augmented AppSec (SAST/DAST) · LLM-Generated Code Security Benchmarking · Agentic Malware Analysis · DevSecOps Automation · Threat Modeling & Security Education
| Work | Venue / artifact |
|---|---|
| Compared to What? A Human-Anchored Security Benchmark for LLM-Generated IaC | arXiv 2608.28021 · code · dataset |
| Shift Intent Left: Securing the Agentic SDLC | Zenodo DOI · repo |
| quantum-safe: Production PQC for Python | arXiv 2605.17061 · PyPI |
| quantum-safe-ts: Hybrid PQC for TypeScript, byte-compatible with quantum-safe-py | Zenodo DOI · repo |
| Quantum-Safe Code Auditor | arXiv 2604.00560 · repo |
| Project | What it is |
|---|---|
| 🧪 GenIaC-SecBench | Human-anchored security benchmark for LLM-generated Infrastructure-as-Code |
| 🎯 Shift-Intent-Left | Framework making developer intent the first securable artifact for coding agents |
| 🔐 quantum-safe-py | Hybrid post-quantum KEM & signatures for Python, migration tooling, CI audit scanner |
| 🔷 quantum-safe-ts | The same, for TypeScript/JS — ML-KEM, ML-DSA, SLH-DSA, PQC JWTs, byte-compatible with the Python library |
| 🔎 quantum-safe-auditor | Finds quantum-vulnerable crypto, filters false positives with LLMs, ranks by attack cost |
| 🛡️ agentic-ai-security-guide | Leadership guide to governing AI agents, for CISOs and CTOs |
| 🗺️ AppSec-Atlas | Open-source application security knowledge base (54 modules) |
| 🧰 DevCipher | 100+ in-browser crypto and developer tools; nothing leaves your device |
| Package | Registry | What it does |
|---|---|---|
quantum-safe-py |
PyPI | Hybrid post-quantum cryptography for Python |
quantum-safe-ts |
npm | Hybrid post-quantum cryptography for TypeScript/JS |
quantum-safe-audit |
npm | Scans JS/TS projects for quantum-vulnerable cryptography |
quantum-safe-mcp |
npm | MCP server letting coding agents audit and migrate crypto |
- 🎓 Industry mentor for security and AI programs at IIT Roorkee and IIT Mandi, and through professional training partners
- 📘 Threat Modeling: interactive 10-module curriculum
- 🧑🏫 Workshops & trainings: secure code review, applied crypto labs
- 💬 Open to mentoring early-career security engineers — reach out on LinkedIn
My research tools, datasets and teaching material are free and open. If they help you or your team, consider sponsoring me on GitHub. Sponsorship directly funds dataset curation, compute for benchmarks, and keeping these projects maintained.