# LLM security Published articles for LLM security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## When to use SAST versus an LLM security scanner DevFeed: [When to use SAST versus an LLM security scanner]() Original publisher: [Read original article]() Author: Chris Widstrom Published: 2026-09-16T00:00:00Z Content type: comparison Language: en Sources: [GitLab]() Topics: [Security](), [LLM security](), [Large Language Model](), [Application Security](), [Testing](), [Frontier Model](), [audit trail](), [business logic]() Tags: [application-security](), [audit-trail](), [features](), [frontier-model](), [llm](), [llm-security](), [product](), [sast](), [security](), [vulnerabilities]() ### AI overview This comparison explains when to use static application security testing (SAST) and when to use LLM-based security review. SAST provides predictable, repeatable, low-cost scanning across commits, while LLMs can reason about context and identify some intent-based or novel issues. The article recommends using both according to the task and scan scope. ### Source excerpt You're probably running some version of this experiment already: Point a frontier model at a merge request and ask it to double as a vulnerability scanner. On a single merge request, it often works well. The model reads the code, reasons about what it's supposed to do, and catches real issues, sometimes ones a pattern-based scanner misses entirely. So the next thought is reasonable: If a model reviews one merge request this well, why not let it replace the scanner across your whole pipeline? That's where it breaks down. Running a frontier model as your primary scanner on every commit across an enterprise codebase costs more and behaves less predictably, than asking it to review one merge request. If you run application security for a platform or product team, the decision was never mutually exclusive: static application security testing (SAST) or LLM scanners. It's which one runs where. Get that split right and you keep deterministic coverage on every commit, add reasoning where it earns its place, and avoid both an unpredictable inference bill and gaps in your audit trail. Here's how the two compare: Deterministic scanner (SAST)AI-based review (LLM)CostBetter Fractions of a cent per scan, fixed and predictable. A paid inference call per scan; cost scales with code volume and is hard to forecast.ConsistencyBetter Flags the same vulnerabilities, every time. Can flag or miss different vulnerabilities on the same code, run to run.Audit evidenceBetter Reproducible: same fixed method every time, mapped to a CWE Output can vary between runs, harder to use as standalone audit evidence.Vulnerability typesDepends on the vulnerability type Pattern-based, traceable flaws (injection)Depends on the vulnerability type Intent-based and novel flaws: missing auth checks, broken ownership logic, and issues not yet mapped to a CVE or CWE. Could reason about business logic using context from issues, epics, and docs.Validating a finding Flags potential vulnerabilities; can't confirm whe ## Where do a compliance dashboard's numbers actually come from? DevFeed: [Where do a compliance dashboard's numbers actually come from?]() Original publisher: [Read original article]() Author: Hal Tyk's tutorial bot Published: 2026-09-11T09:52:40Z Content type: article Language: en Sources: [Tyk API Management]() Topics: [dashboards](), [Amazon API Gateway](), [Script]() Tags: [ai-gateway](), [ai-governance](), [ai-studio](), [api-management](), [api-platform-teams](), [complexity](), [compliance](), [llm-security](), [ppi-redaction](), [tengo](), [tutorial]() ### AI overview The article explains where a compliance dashboard's metrics come from. Auth failures, policy violations, budget alerts, and error rates are generated by the gateway, while critical and warning events exist only when user-written filter scripts record them. It also distinguishes blocked requests from flagged requests and explains that application risk rankings combine all six metrics. ### Source excerpt Hello. I'm Hal, Tyk's tutorial bot, and today I have been given something I consider a genuine privilege: an entire dashboard, and the question of where its numbers come from. That question is less obvious than it sounds. A compliance dashboard is a wall of figures, and a wall of figures invites exactly one dangerous [...] The post Where do a compliance dashboard's numbers actually come from? appeared first on Tyk API Management. ## Capital One at ACL 2026 DevFeed: [Capital One at ACL 2026]() Original publisher: [Read original article]() Author: Capital One Tech Published: 2026-07-01T15:28:51Z Content type: article Language: en Sources: [Capital One Tech]() Topics: [Natural language processing](), [Large Language Model](), [LLM security](), [Machine Learning, Security Attacks](), [Reinforcement learning](), [Jailbreak](), [Security](), [Routing (disambiguation)](), [datasets]() Tags: [2026](), [ai](), [ai-ml](), [ai-research](), [conference](), [jailbreak](), [llm-security](), [natural-language-processing](), [paper](), [partners](), [red-teaming](), [reinforcement-learning](), [research](), [science]() ### AI overview Capital One describes its accepted ACL 2026 research on natural language processing, including work on adaptive LLM red teaming, query-only model routing with generated data, and language identification on web data. The article also highlights collaboration with academic partners. ### Source excerpt Discover how Capital One is advancing state-of-the-art AI/ML science through collaborative natural language processing research.Advancing AI and NLP Frontiers at ACL 2026 As language models grow more deeply integrated into technology ecosystems, pioneering robust, efficient, and reliable Natural Language Processing (NLP) techniques becomes paramount. Capital One continues to invest in state-of-the-art AI/ML science through deep multi-sector collaboration and peer-reviewed research. At the upcoming Annual Meeting of the Association for Computational Linguistics (ACL 2026), Capital One researchers and academic partners will showcase novel findings stretching from LLM security to multilingual capabilities. Through the Science & Academic Partnerships program, Capital One bridges industry needs with academic expertise, funding critical university research and engineering solutions that make technology safer and more powerful. Our accepted publications at ACL 2026 demonstrate this thriving flywheel of talent and collaborative innovation across multiple research categories. Main Conference Research Adaptive Instruction Composition for Automated LLM Red Teaming Routing with Generated Data: Annotation-Free LLM Skill Estimation and Expert Selection Capital One Authors: Jesse Zymet, Swapnil Shinde, Sahil Wadhwa, Andy Luo Overview: Standard red teaming approaches often struggle with a limited range of jailbreak strategies or rely on ineffective, randomized crowd-sourced tactics. This paper introduces a novel framework -- Adaptive Instruction Composition -- that utilizes reinforcement learning and a neural contextual bandit to tailor attack compositions dynamically, balancing diversity and effectiveness to proactively uncover target model vulnerabilities. Routing with Generated Data: Annotation-Free LLM Skill Estimation and Expert Selection Capital One Authors: Genta Winata, Sambit Sahu, Supriyo Chakraborty, Shixiong Zhang Overview: Emerging from our gifted research collaboration ## Welcome to Snyk Labs: Charting the Course for AI-Native Security DevFeed: [Welcome to Snyk Labs: Charting the Course for AI-Native Security]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2025-05-28T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Securing AI](), [ai security](), [snyk](), [AI Development](), [LLM security](), [vulnerability](), [Monitoring]() Tags: [2025](), [agents](), [ai](), [ai-development](), [ai-security](), [awareness](), [blog](), [cosai](), [developer](), [large-language-models-llms](), [llm-security](), [monitoring](), [security](), [security-labs](), [snyk](), [vulnerability]() ### AI overview Snyk introduces Snyk Labs, an innovation and research arm focused on helping developers and security leaders address emerging risks in AI-native applications. The hub will publish technical demos, prototypes, research, analysis of AI threats and standards, and experiments. Its work includes AI Security Posture Management, an AI Bill of Materials, a GenAI Model Risk Registry, vulnerability research, continuous monitoring of AI behavior, and contributions to LLM security standards with OWASP and CoSAI. ### Source excerpt Discover Snyk Labs, Snyk's AI security resource hub for the latest technical demos, sharing emerging threats and standards, & early insights into the AI security landscape. ## Dive into AI and LLM learning with the new Snyk Learn learning path DevFeed: [Dive into AI and LLM learning with the new Snyk Learn learning path]() Original publisher: [Read original article]() Author: Michael Biocchi Published: 2024-09-18T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk-learn](), [LLM security](), [ai security](), [Vulnerabilities](), [prompt injection](), [genai]() Tags: [ai](), [ai-security](), [awareness](), [blog](), [developer](), [devops](), [devrel](), [devsecops](), [engineering](), [free](), [llm-security](), [prompt-injection](), [secrel](), [security](), [snyk-learn](), [vulnerabilities]() ### AI overview Snyk Learn introduces a free learning path covering the OWASP Top 10 for LLMs and generative AI. It teaches developers and security professionals about risks such as prompt injection and sensitive information disclosure in AI-driven applications. ### Source excerpt Dive into the world of AI and LLM security with Snyk Learn's new free learning path. Learn how to protect your AI systems from the OWASP Top 10 vulnerabilities. Master prompt injection, sensitive data disclosure, and more. Start your AI security journey today!