Cisco evolves its Secure Development Lifecycle (CSDL) with AI agents, Project CodeGuard and an always-on offensive security harness
Cisco describes how it is adapting its Cisco Secure Development Lifecycle (CSDL), built on more than 400 software security requirements, to AI-assisted and agentic software engineering. The security bar is unchanged, but requirements become atomic, machine-readable and contextual so that engineers and AI agents can act on them directly. Cisco separates what is running today (Project CodeGuard, an always-on offensive security harness) from what is still in development (a secure software guidance skill and the automated security evaluation agent). This is vendor product and process news with no vulnerability, incident or active threat described.
Detalhes técnicos
- Project CodeGuard is open-sourced, donated to the Coalition for Secure AI (CoSAI) and used internally. It supplies rules and skills that steer AI coding agents toward safe patterns, and it also acts as an evaluator backing hard gates in the pipeline.
- The secure software guidance skill (in development) carries Cisco-specific requirements from the PRD through the spec and later phases of development.
- The automated security evaluation agent (ASE) (in development) builds a threat model, maps applicable requirements to the architecture and trust boundaries, and checks source code for evidence. A second agent adds context such as PRDs, design reviews and test results. A named human reviewer decides which findings apply. Cisco says this replaces 40 to 80 hours of manual review per assessment.
- The Foundry Security Spec, an open-sourced offensive security harness specification, is already operationalized. Cisco states that it has not found a novel issue not already covered by an existing requirement. Findings feed back into threat models, requirements and tuning of static analysis to reduce false positives.
- Stated core principles: security and privacy by design, secure by default, software supply chain security, hardened foundations, continuous validation, continuous improvement and rapid remediation.
Remediação
No remediation is required. Organizations building software may consider adopting similar practices, such as machine-readable security requirements, agent-enforced gates and continuous evidence collection.
Linha do tempo
-
Cisco evolves its Secure Development Lifecycle (CSDL) with AI agents, Project CodeGuard and an always-on offensive security harness
ler a análise desta fonte ocultar
Cisco describes how it is adapting its Cisco Secure Development Lifecycle (CSDL), built on more than 400 software security requirements, to AI-assisted and agentic software engineering. The security bar is unchanged, but requirements become atomic, machine-readable and contextual so that engineers and AI agents can act on them directly. Cisco separates what is running today (Project CodeGuard, an always-on offensive security harness) from what is still in development (a secure software guidance skill and the automated security evaluation agent). This is vendor product and process news with no vulnerability, incident or active threat described.
Technical Details
- Project CodeGuard is open-sourced, donated to the Coalition for Secure AI (CoSAI) and used internally. It supplies rules and skills that steer AI coding agents toward safe patterns, and it also acts as an evaluator backing hard gates in the pipeline.
- The secure software guidance skill (in development) carries Cisco-specific requirements from the PRD through the spec and later phases of development.
- The automated security evaluation agent (ASE) (in development) builds a threat model, maps applicable requirements to the architecture and trust boundaries, and checks source code for evidence. A second agent adds context such as PRDs, design reviews and test results. A named human reviewer decides which findings apply. Cisco says this replaces 40 to 80 hours of manual review per assessment.
- The Foundry Security Spec, an open-sourced offensive security harness specification, is already operationalized. Cisco states that it has not found a novel issue not already covered by an existing requirement. Findings feed back into threat models, requirements and tuning of static analysis to reduce false positives.
- Stated core principles: security and privacy by design, secure by default, software supply chain security, hardened foundations, continuous validation, continuous improvement and rapid remediation.
Remediation
No remediation is required. Organizations building software may consider adopting similar practices, such as machine-readable security requirements, agent-enforced gates and continuous evidence collection.