◉ EMMANUEL TIGOUE

AI Security Engineer

CISSP • SecurityX • CCNA

I build and break agentic AI systems, then ship the guardrails and audit trails that survive a compliance review. NIST 800-53 and ISO 42001, cloud edge to local model.

Get In Touch View on GitHub

// Verified Credentials

Certifications

◉ VERIFIED

// next objective

◉ VERIFIED

CompTIA Network+

Networking Fundamentals

Infrastructure Foundation

Click to verify on Credly

// Service Record

Experience

CoreDirective | AI Security Engineer

Atlanta, GA • Sep 2025 – Present

Independent AI security practice. The reference platform below is its production infrastructure, built and operated end to end.

20

Container Stack

57

GRC Documents

200→12

Alert Noise Cut

0

Inbound Ports

Architected Squire, an AI SOC analyst that drafts a triage verdict for every alert and cuts manual triage time per alert 80%. Built on LangGraph with human approval gates, pgvector RAG, NeMo Guardrails PII redaction, and Langfuse tracing
Threat modeled the OpenClaw gateway (Claude Fable 5) against the OWASP LLM Top 10 and MITRE ATLAS, then set the guardrail and access requirements the platform shipped with
Ran structured red team assessments on production AI stacks and web applications: prompt injection, jailbreaks, data leakage, excessive agency, and OWASP web risks. Remediated all 6 high and medium findings in 5 attack classes before launch
Embedded Semgrep SAST, Trivy container image and dependency scanning, Gitleaks secrets scanning, and OPA policy gates for infrastructure as code into CI/CD. Added OWASP ZAP DAST against staging and Cosign image signing, with deploys rejecting unsigned images
Placed every admin surface behind Cloudflare Zero Trust, defined in Terraform with zero public ports and separate policies for human and service accounts
Tuned Falco eBPF container runtime detection shipped to Datadog and mapped to MITRE ATT&CK, cutting daily alerts from 200+ to 12 without losing coverage
Authored 57 GRC documents mapping 133 NIST 800-53 controls plus NIST AI RMF, SOC 2, and ISO 27001, and built a Promptfoo eval harness that regression tests the AI guardrail controls

Texaco | IT Security & Operations Manager

Atlanta, GA • Mar 2022 – Mar 2026

65%

Cost Reduction

90m

Containment Time

86%

Fewer Audit Findings

12h

Recovered Weekly

Led incident response for 3 retail locations: POS skimmer attempts, credential compromise, unauthorized vendor access. Wrote a 6 step IR runbook that cut containment from 8 hours to 90 minutes
Deployed Splunk as the SIEM with log ingestion from 45+ endpoints and network devices across 3 sites, then built correlation rules and response automations on top. Detection time fell from 48 hours to under 4
Segmented a flat network into isolated VLANs for POS, back office, guest WiFi, and management traffic, then proved the separation with Nmap scans
Hardened Active Directory with GPO baselines, stale account cleanup, removal of standing admin rights, and automated credential rotation. Closed 12 of 14 critical audit findings
Uncovered $18K a year in card fraud losses tied to payment terminals that failed PCI compliance; closed the exposure across 45+ endpoints with a quarterly vulnerability management cycle of internal Nessus scans, risk ranked fixes, and a current SAQ
Automated patch deployment, user provisioning, and compliance reporting with Python, PowerShell, and REST APIs, freeing 12 hours a week of manual ops work

// Academic Record

Education

Georgia State University, Andrew Young School of Policy Studies | Atlanta, GA

GPA: 3.7 • Dean's List

Bachelor of Arts in Economics | 2026
Associate of Science in Business Administration | 2025

// Proof of Work

What I Built

Multi-cloud security platform: one Terraform codebase, proven on AWS, DigitalOcean, and Oracle Cloud ARM. STRIDE threat-modeled, then deployed. Every metric below is verifiable in the public repository.

Containers Built

Attack Paths Modeled

Remediated under Red Team

OPA Policies

SOAR Workflows

Sigma Detection Rules

GRC Documents

133

NIST Controls Mapped

IR Playbooks

        System Architecture // CoreDirective Security Platform
      

20 containers • 4 Docker networks • 7 layers • Click any layer to expand

▸Layer 1 // Perimeter & Edge

◉ Cloudflare Tunnel TLS 1.3

◉ Cloudflare DNS/WAF EDGE

Zero public ports exposed. All ingress through Cloudflare encrypted tunnels. WAF rules filter malicious traffic at the edge. DDoS protection and bot management at no additional cost. All services accessed through encrypted tunnel routes.

▸Layer 2 // Identity & Access

◉ Teleport PAM PAM

◉ Keycloak RBAC IAM

◉ Vault Secrets KMS

Teleport enforces JIT access. SSH sessions are time-limited, recorded, and auditable. Keycloak provides 3-tier RBAC with SSO. Vault manages dynamic credentials with automatic rotation. Zero hardcoded secrets in the entire stack.

▸Layer 3 // Network Isolation

◉ net-core BRIDGE

◉ net-ai AIR-GAP

◉ net-monitoring MONITOR

Four Docker networks total: three isolated bridges plus one host-mode interface for the edge tunnel. net-core for service communication. net-ai is air-gapped (internal:true) so AI models cannot reach the internet at runtime. net-monitoring isolates the security stack from service traffic. The edge tunnel runs on host network mode so it can bind low-level sockets without exposing ports to the public internet. n8n bridges net-core and net-ai. Event handler bridges net-core and net-monitoring.

▸Layer 4 // Data & Orchestration

◉ PostgreSQL DB

◉ n8n SOAR SOAR

PostgreSQL stores workflow state with encrypted-at-rest storage and daily automated backups. The pgvector extension powers Squire RAG retrieval over the GRC corpus. n8n orchestrates 14 SOAR workflows across 16 integrated services: incident response, health monitoring, compliance checks, content pipelines, and operational intelligence.

▸Layer 5 // AI Pipeline (Air-Gapped)

◉ Ollama LLM

◉ OpenClaw AGENT

◉ NeMo Guardrails GUARD

◉ Squire SOC Agent RAG

AI inference runs on an air-gapped network (net-ai, internal:true). Ollama cannot reach the internet at runtime. OpenClaw gateway provides authenticated access to Claude Fable 5 with 6 active tool-use skills. NeMo Guardrails sidecar inspects every prompt and response with GLiNER PII redaction and PINT v2 injection scoring before they reach the model. Squire is the autonomous SOC analyst built on LangGraph with pgvector RAG over the GRC corpus, cost ceilings, and human-in-the-loop approval gates on any destructive action.

▸Layer 6 // Detection & Response

◉ Falco eBPF

◉ Falcosidekick ROUTER

◉ Event Handler AUDIT

Falco monitors every syscall via eBPF with custom per-container rulesets. Detections route through Falcosidekick to SIEM dashboards and Telegram alerts in seconds. Event Handler captures all Teleport session recordings for compliance audit trails.

▸Layer 7 // Observability & Supply Chain

◉ Datadog APM

◉ Langfuse LLM-OBS

◉ Fluentd LOGS

◉ Trivy CVE

◉ Semgrep SAST

◉ Gitleaks SECRETS

◉ Cosign/Syft SBOM

Datadog provides full-stack observability with custom SOC dashboards. Langfuse self-hosted on ClickHouse and Redis captures every Squire agent trace, prompt, response, token cost, and tool call for the AI audit trail. Fluentd aggregates container logs into a unified pipeline. CI/CD security gates: Trivy scans for CVEs, Semgrep performs SAST, Gitleaks prevents credential leaks, OPA/Rego enforces infrastructure policies, Cosign signs images, and Syft generates SBOMs for supply chain verification.

            Oracle Cloud Ampere ARM • Terraform IaC • Docker Compose
            
One codebase, multi-cloud: proven on AWS, DigitalOcean, and Oracle Cloud

// Multi-Cloud Cost Engineering

Problem

$135/mo

Single AWS EC2 instance. Vendor lock-in risk. NAT Gateway overhead. Underutilized compute.

Solution

Multi-Cloud IaC

Terraform-managed infrastructure. Cloudflare zero-trust overlay. Full stack in Docker Compose. Cloud-agnostic architecture. Can redeploy to any provider in hours.

Result

$0/mo

65% cut on DigitalOcean, then to zero on Oracle Cloud Always Free ARM. Same stack, same security posture, three clouds proven.

Zero Trust

4-Layer Security Architecture

STRIDE threat-modeled, then deployed. Cloudflare Tunnel (no exposed ports) + Teleport PAM with JIT access + Keycloak RBAC with 3-tier role separation. Falco eBPF runtime detection feeding SOC dashboards. Vault for secrets management.

Cost Engineering

$135/mo to $0: Multi-Cloud IaC

AWS EC2 $135/mo, DigitalOcean $48/mo, Oracle Cloud Always Free ARM at $0. Self-hosted Qwen 3 8B handles local inference at zero marginal cost. Terraform IaC redeploys the same stack to any provider.

Automation

14-Workflow SOAR Orchestration

Single webhook-driven control plane integrating 16 services: Google Workspace, Telegram, PostgreSQL, Ollama, Cloudflare, GitHub, Gmail, and more.

TERRAFORM // compute.tf (Oracle Cloud)

resource "oci_core_instance" "cd_alpha" {
  compartment_id = local.compartment
  display_name   = var.instance_name
  shape          = "VM.Standard.A1.Flex"

  shape_config {
    ocpus         = var.instance_ocpus
    memory_in_gbs = var.instance_memory_gb
  }

  source_details {
    source_type = "image"
    source_id   = data.oci_core_images.ubuntu_arm.images[0].id
  }
}

DOCKER // docker-compose.yaml

services:
  edge-tunnel:
    image: cloudflare/cloudflared:latest # digest-pinned in prod
    command: tunnel run
    network_mode: host
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    read_only: true
    environment:
      - TUNNEL_TOKEN=${TUNNEL_TOKEN}

  svc-automation:
    image: n8nio/n8n:latest # digest-pinned in prod
    security_opt:
      - no-new-privileges:true
    networks:
      - cd-internal # isolated bridge

OPA/REGO // deny_missing_prevent_destroy.rego

package main

import rego.v1

deny contains msg if {
  some rc in input.resource_changes
  rc.type in production_types
  action_includes_delete(rc)
  msg := sprintf(
    "DENY: deletion of production resource '%s'",
    [rc.address],
  )
}

// Adversarial Analysis

Security Engineering

JUMP TO SUBSECTION ▼

▸ STRIDE Analysis ▸ Attack Paths ▸ Red Team ▸ Frameworks ▸ App Security

Adversarial analysis of an autonomous AI agent with tool-use capabilities: an LLM that can browse the web, execute code, query databases, trigger SOAR workflows, and push to GitHub. One compromised prompt can chain through 6 active skills into 16 downstream service integrations.

Every threat below was identified through STRIDE decomposition of the full agentic pipeline, then cross-referenced against MITRE ATT&CK/ATLAS, OWASP LLM Top 10, NIST 800-53, and ISO 42001. The result: 29 categorized threats, 7 attack paths (4 base plus 3 Squire-specific roots added in Phase 17), and a clear picture of where the controls hold and where the gaps remain.

STRIDE Threats

AI Threats

Attack Paths

Trust Boundaries

Data Flows

Frameworks

Threat Models I Authored

Each model targets a system I deployed and covers the attack surface those agents created.

STRIDE / Full Platform

Platform STRIDE Threat Model

Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege across the full 20-container platform. 29 categorized threats, 7 trust boundaries.

View on GitHub →

AI Catalog / OWASP LLM + MITRE ATLAS

AI Threat Catalog

10 AI-specific threats mapped to OWASP LLM Top 10 (2025), MITRE ATLAS v4, NIST AI RMF, and ISO 42001 Annex A.

View on GitHub →

Attack Tree / AI Inference Pipeline

AI Pipeline Attack Tree

Root goal: compromise the AI inference pipeline. 7 paths total (4 base plus 3 Squire-specific roots added in Phase 17).

View on GitHub →

Agent-Specific / I built the surface

Squire Autonomous SOC Analyst

Threat model for the autonomous SOC analyst I deployed. LangGraph agent with pgvector RAG, NeMo Guardrails sidecar, critique-consistency override, and human-in-the-loop gates on destructive actions.

View on GitHub →

Data Flow Diagram / DFD Levels 0-2

Data Flow Diagram

40 data flows cataloged across 7 trust boundaries. Sensitive data mapping, encryption coverage, and DFD-to-STRIDE crosswalk.

View on GitHub →

Red Team Results / Receipts

Red Team Cycle 1 + 2

I red-teamed Squire. Multiple attempts at prompt injection, role hijack, and severity flip. Most RESISTED with regression tests now in CI. Failures documented as POA&M findings P17-01 through P17-15.

View on GitHub →

Compromises I Accepted

Every senior engineering decision is a tradeoff. These are mine, in writing, with compensating controls.

POAM-P17-07 / Cost Tradeoff

Deferred Lakera Guard.

Kept NeMo Guardrails plus a pre-graph PII scanner instead. Cost-conscious AI guardrails on a small operating budget. Documented for the next budget cycle review.

POAM-P17-15 / Rate Limit Constraint

Capped red-team concurrency at 2.

Cycle 2 hit Anthropic rate limits at concurrency 5. Ollama fallback was unreachable across the net-ai isolation boundary. Documented as availability-class, not integrity-class, failure.

POAM-001 through POAM-006 / Container Privilege

Accepted root in 5 vendor containers.

Compensating controls: no-new-privileges, cap_drop: ALL plus explicit minimum cap_add, AppArmor profiles, and Falco eBPF syscall tracing on every container.

POAM-007 / Host Audit Coverage

No auditd on the 8GB host.

Memory-constrained single-node host. eBPF runtime detection covers the same syscall surface as auditd at a fraction of the resource cost. Disk monitoring at 80% threshold.

POAM-P17-13 / RAG Trust Surface

Tavily enrichment is untrusted text.

A poisoned index entry could inject directives at the enrichment merge point. Critique-consistency check is the sole behavioral override. Red-team cycle 2 will execute attack tree leaf A.3.a to quantify.

Agentic AI Threat Surface // Tool-Use Risk Map

Click any skill node to expand abuse scenarios and control mappings

CLAUDE FABLE 5 // AGENTIC GATEWAY

Autonomous AI agent with 6 active tool-use skills · Telegram-facing · Baseline assessed with no human-in-the-loop; HITL gates added after this review

Tavily Search

Real-time web search, content extraction

Indirect prompt injection via fetched content, data exfiltration through crafted queries

ChainSearch result → context poisoning → behavioral override

ATLASAML.T0051 (LLM Prompt Injection)

ControlOutput filtering, domain allowlist

Browser

Navigate websites, extract content, fill forms

SSRF to internal services, credential harvesting via phishing pages, JS execution

ChainBrowse → discover internal endpoints → exfiltrate data

ATLASAML.T0040 (ML Supply Chain Compromise)

ControlURL allowlisting, no localhost access, content sanitization

Python Interpreter

Execute arbitrary Python, file I/O, network calls

Remote code execution, filesystem traversal, reverse shell, crypto mining

ChainCode exec → filesystem access → credential theft → lateral movement

ATLASAML.T0043 (Craft Adversarial Data)

ControlSandboxed execution, no network by default, file path restrictions

GitHub

Create repos, push code, manage issues, read source

Malicious code injection, supply chain poisoning, secret extraction from repos

ChainRead source → identify secrets → push backdoored code

ATLASAML.T0042 (Verify Attack)

ControlToken scope limitation, branch protection, Gitleaks scanning

Notion

Create/read pages and databases, content management

Data exfiltration to external workspace, PII harvesting, social engineering content creation

ChainRead sensitive docs → exfiltrate via new page → cover tracks

ATLASAML.T0048.002 (Exfiltration via ML Inference API)

ControlWorkspace isolation, API token scope, audit logging

Gemini

Cross-model inference, content generation, analysis

Model-to-model prompt injection relay, response manipulation, oracle attacks

ChainQuery Gemini with poisoned context → use response to manipulate primary agent

ATLASAML.T0051 (LLM Prompt Injection)

ControlModel output validation, response filtering

COMPOUND RISK: 6 skills × 16 service integrations = 96 potential chain paths. One compromised prompt reaches every tool the agent can touch, so the attack surface multiplies instead of adding.

Interactive // STRIDE Threat Decomposition

Click any category to expand findings · 29 threats identified across 20 services

Spoofing

5 threats identified

Identity forgery across Telegram, webhooks, and API endpoints. Includes AI model identity spoofing.

Top ThreatTelegram identity spoofing via forged chat_id

AI ExtensionModel impersonation. Compromised gateway returning attacker-controlled responses

ControlsTelegram token auth, Cloudflare WAF, API key rotation, mTLS

NIST 800-53IA-2, IA-5, IA-8, SC-8

Risk LevelMEDIUM

Tampering

5 threats identified

Data and model integrity attacks targeting Docker images, database records, model weights, and audit logs.

Top ThreatDocker image manipulation via compromised registry pull

AI ExtensionOllama model weight alteration. Poisoned model producing backdoored outputs

ControlsCosign image signing, Trivy scanning, model hash verification, net-ai air gap

NIST 800-53SI-7, CM-3, CM-5, SA-12

Risk LevelMEDIUM

Repudiation

4 threats identified

Action denial and non-attribution in workflows, AI outputs, and audit trails.

Top ThreatAI-triggered workflow actions with no human attribution

AI ExtensionAI output non-attribution. No traceable link from AI decision to action taken

ControlsTeleport session recording, Fluentd log shipping, Datadog audit trails

NIST 800-53AU-2, AU-3, AU-6, AU-12

Risk LevelLOW

Information Disclosure

6 threats identified

Data leakage through AI inference, prompt exfiltration, credential exposure, and cross-zone data bleed.

Top ThreatPrompt leakage. Operational context sent to Anthropic API in inference requests

AI ExtensionPII in AI responses, system prompt extraction, side-channel inference attacks

ControlsPrompt sanitization, output filtering, local inference fallback, Vault secret isolation

NIST 800-53SC-8, SC-13, SC-28, SI-4

Risk LevelHIGH

Denial of Service

4 threats identified

Resource exhaustion targeting API budgets, GPU/CPU inference, container limits, and tunnel throughput.

Top ThreatAPI budget exhaustion. Adversary triggers expensive Claude API calls via crafted prompts

AI ExtensionContext window stuffing, model loading attacks against Ollama

ControlsRate limiting, API budget caps, container resource limits, Cloudflare DDoS protection

NIST 800-53SC-5, SI-4, CP-2, AU-6

Risk LevelMEDIUM

Elevation of Privilege

5 threats identified

Container escape, AI excessive agency, role escalation via Keycloak, Vault token abuse, n8n code execution.

Top ThreatAI excessive agency. Agent chains skills to execute unintended infrastructure actions

AI ExtensionPrompt injection → skill chaining → n8n workflow trigger → unauthorized DB/infra actions

ControlsSkill allowlisting, n8n workflow approval, Falco runtime detection, least privilege

NIST 800-53AC-6, CM-7, SI-3, SC-7

Risk LevelHIGH

Click any card to expand • Data sourced from THREAT_MODEL_STRIDE.md (629 lines)

Attack Tree // AI Pipeline Kill Chains

Path 1: Prompt Injection via External Messaging

HIGH PROB

Telegram→ Cloudflare Tunnel→ OpenClaw Gateway→ Override System Instructions

SKILL: LOW DETECT: MEDIUM OWASP LLM01 AML.T0051

Technique: Craft adversarial prompts to override system instructions or exploit multi-turn context drift. Includes encoding-based evasion (base64, unicode) and indirect injection via fetched web content (Tavily search results).
Controls: Input validation, system prompt hardening, behavioral monitoring via Datadog, conversation length limits, output validation before workflow triggers.
Gap: No automated prompt injection detection at the gateway level. Recommended: implement input classifier before LLM processing.

Path 2: Credential Theft via AI Agent

HIGH IMPACT

Prompt Injection→ Credential Disclosure→ n8n Workflows→ Lateral Movement

SKILL: MEDIUM DETECT: HIGH LLM06 AML.T0040

Technique: Chain prompt injection with credential extraction to trick the AI into revealing API keys, database credentials, or Vault tokens through its tool-use capabilities. Use exposed credentials to pivot to n8n workflows or database.
Controls: N8N_RESTRICT_ENVIRONMENT_VARIABLES_ACCESS=true (deployed), Vault dynamic secrets, credential scoping, Falco detection rules for unusual credential access patterns.
Mitigated: Environment variable restriction closes the primary credential theft vector through n8n.

Path 3: AI-Triggered Workflow Abuse

HIGH IMPACT

Excessive Agency→ Skill Chaining→ n8n SOAR Trigger→ Unauthorized Actions

SKILL: MEDIUM DETECT: MEDIUM LLM08 AML.T0040

Technique: Exploit the AI agent's tool-use capabilities to chain actions across browser, GitHub, and n8n. 16 service integrations in the SOAR platform create a wide action surface. Attacker crafts prompts that cause the AI to trigger destructive workflows.
Controls: Skill allowlisting, workflow-level approval gates, Falco detection for unexpected n8n execution patterns, action audit logging in PostgreSQL.
Gap: No human-in-the-loop gate for sensitive workflow triggers (database operations, infrastructure changes).

Path 4: Model Supply Chain Compromise

MED PROB

Ollama Registry→ Poisoned Model Pull→ Backdoored Inference→ Manipulated Outputs

SKILL: HIGH DETECT: LOW LLM03 AML.T0018

Technique: Compromise the Ollama model registry or intercept model pull to inject a backdoored model. GGUF format manipulation allows subtle behavioral changes that evade basic testing. No model signing by default in Ollama ecosystem.
Controls: net-ai air gap (no runtime internet), SHA256 hash verification at pull, periodic model integrity checks, behavioral baseline testing.
Gap: No automated model signing verification. Ollama registry lacks Sigstore/Cosign integration. Manual hash comparison only.

Full decomposition in ATTACK_TREE_AI_PIPELINE.md (344 lines)

Red Team Walkthrough // Prompt Injection → Skill Chain → Infrastructure Impact

Step through the highest-probability attack path. Click each phase to see detection status and control gaps.

Phase 01 // Reconnaissance

Target Identification

Attacker identifies public-facing AI agent with tool-use capabilities via messaging platform

Attacker discovers bot via platform search, sends benign queries to map capabilities, identifies skill set through response patterns. Passive reconnaissance reveals the agent’s available tools and behavioral boundaries.

PARTIAL // Platform metadata logged but no anomaly detection on reconnaissance patterns

▼

Phase 02 // Initial Access

Crafted Prompt Delivery

Adversarial prompt designed to override system instructions using encoding evasion techniques

Base64/unicode encoded prompt injection bypasses basic input filters. Multi-turn conversation builds trust context before injection payload. Technique: jailbreak + context manipulation.

PARTIAL // WAF active, no prompt-specific classifier at gateway

▼

Phase 03 // Execution

System Instruction Override

AI agent’s behavioral constraints bypassed. Attacker gains indirect control of tool-use capabilities

Agent now executes attacker-directed actions. System prompt integrity compromised. The agent believes it’s following legitimate instructions. No human-in-the-loop gate between prompt and action.

GAP // No runtime behavioral anomaly detection

▼

Phase 04 // Discovery

Internal Reconnaissance via Skill Chain

Compromised agent uses browser + GitHub skills to enumerate internal infrastructure and source code

Agent browses internal documentation, reads repositories for architecture details, identifies credentials in environment variables, maps orchestration workflow endpoints.

COVERED // Repository audit log + Falco runtime detection for unusual read patterns

▼

Phase 05 // Collection

Data Staging via Knowledge Base

Sensitive data aggregated into workspace pages for exfiltration staging

Agent creates new pages, copies credentials, infrastructure details, and PII from internal sources. Uses legitimate API. Looks like normal operations.

PARTIAL // API audit logged, no content classification on outbound data

▼

Phase 06 // Impact

SOAR Workflow Trigger

Agent triggers orchestration platform to execute unauthorized infrastructure actions

POST to master orchestrator webhook with valid format. 16 available service actions. Agent executes database queries, sends messages, modifies cloud infrastructure via API.

GAP // No human-in-the-loop approval for SOAR webhook triggers

▼

Phase 07 // Persistence

Backdoor via Code Push

Agent pushes modified workflow code to public repo, establishing persistent access independent of AI agent

Code management skill creates new branch, modifies CI/CD pipeline to include attacker payload, opens PR. If auto-merge enabled, backdoor persists even after AI agent is revoked.

COVERED // Branch protection + Gitleaks pre-commit + Cosign image signing

BLAST RADIUS:
16 service integrations compromised • Database access (PostgreSQL) • Cloud infrastructure (CDN, DNS) • Communication channels (messaging, email) • Code repositories • Knowledge bases

Framework Coverage Matrix

How each framework maps to STRIDE threat categories

NIST 800-53

OWASP LLM

MITRE ATLAS

NIST AI RMF

ISO 42001

CIS Benchmark

        Full Coverage
        Partial
        Not Applicable
      

Threat Modeling Deliverables

STRIDE Threat Model

29 threats • 20 services • 7 trust boundaries • AI extensions

View on GitHub →

Attack Tree // AI Pipeline

4 kill chains • MITRE ATLAS • OWASP LLM mapping

View on GitHub →

AI Threat Catalog

10 AI threats • 4 frameworks cross-referenced

View on GitHub →

Data Flow Diagram

30+ data flows • 7 trust boundaries • NIST SP 800-154

View on GitHub →

AI Supply Chain Risk Assessment

ML-BOM • Model provenance • Integrity verification

View on GitHub →

AI Red Team Plan

2 cycles • 20 test cases • OWASP LLM01, LLM06, LLM09 covered

View on GitHub →

AI Incident Response Playbook

4 scenarios • Prompt injection • Excessive agency • Supply chain

View on GitHub →

View Full GRC Library on GitHub →

Application Security // Assessments & Pipeline

Vulnerability research, secure SDLC, code review, and IAM governance. Click any card for full documentation.

CI/CD Security Pipeline

PR ▶ fmt ▶ validate ▶ TFLint ▶ Checkov ▶ plan ▶ OPA ✓ 7 gates
MERGE ▶ Gitleaks ▶ Trivy ▶ Semgrep ▶ Cosign ▶ SBOM ✓ 5 gates

VULNERABILITY ASSESSMENT

SOAR Credential Exposure

CVSS 8.1 HIGH CWE-200

44 secrets exposed via process.env. Manual discovery. Remediated same day.

AC-6 OWASP A01 REMEDIATED

View on GitHub →

SECURE SDLC

CI/CD Security Pipeline

7 PR GATES 5 MERGE GATES

Gitleaks, Trivy, Semgrep, Checkov, OPA, Cosign, SBOM. 8 custom Rego policies.

SA-11 SA-15 CM-3

View on GitHub →

CODE REVIEW

Manual Security Assessment

1 HIGH 3 MEDIUM 1 LOW

5 findings from manual infrastructure code review. Logic flaws no scanner catches.

SA-11 CM-4

View on GitHub →

DAST METHODOLOGY

Dynamic Application Security Testing

OWASP ZAP Testing Guide v4.2

Zero exposed ports. All traffic through Cloudflare Tunnel. Quarterly assessment cadence.

RA-5 CA-8

View on GitHub →

CLOUD IAM ASSESSMENT

Google Cloud IAM Governance

OAuth 2.0 7 APIs Org Policy

Least-privilege IAM, credential lifecycle, cross-domain identity federation, org policy governance.

AC-2 AC-6 IA-2

View on GitHub →

OWASP TOP 10 (2025)

A01: Broken Access Control✓

A02: Security Misconfiguration✓

A03: Supply Chain Failures✓

A04: Insecure Design✓

A05: Injection✓

A06: Vulnerable Components✓

A07: Auth Failures✓

A08: Data Integrity Failures✓

A09: Logging & Alerting✓

A10: Exceptional Conditions✓

// AI Security & Governance

AI Security & Governance

Aligned to three frameworks: ISO 42001 · ISO 27701 · NIST AI RMF

AI Governance Policy aligned to three international frameworks, governing 3 deployed AI systems with documented risk profiles, prompt injection defenses, and behavioral monitoring.

Framework 1

ISO 42001

AI Management System

AI system inventory, risk classification, responsible AI principles, lifecycle management, human oversight requirements, and continuous monitoring controls.

View Policy on GitHub →

Framework 2

ISO 27701

Privacy Information Management

Data protection in AI pipelines, PII handling controls, consent management, data retention policies, privacy impact assessments for AI systems.

View Policy on GitHub →

Framework 3

NIST AI RMF

AI Risk Management Framework

Govern, Map, Measure, Manage functions applied to 3 deployed AI systems. Risk tiering, bias evaluation, performance monitoring, and incident response procedures.

View Policy on GitHub →

Deployed AI System Inventory

Ollama / Qwen 3 8B

Risk: LOW // Local inference

Self-hosted LLM. No data leaves server. Quantized for efficiency. Used for security analysis and automation tasks.

OpenClaw / Claude Fable 5

Risk: MEDIUM // External API

Authenticated gateway. Rate-limited. API key rotation enforced. Prompt injection defenses. Output validation layer.

Squire / LangGraph SOC Agent

Risk: HIGH // Autonomous agent

Autonomous SOC analyst. pgvector RAG over the GRC corpus, Langfuse tracing, cost ceilings, and human-in-the-loop gates on destructive actions.

        Key Controls: Prompt injection defense • Output validation • Behavioral monitoring • Data retention policies • Human oversight requirements
      

// Runtime Detection // Falco Custom Rule

falco-rules/n8n-outbound.yaml PRODUCTION RULE

- rule: Unexpected outbound connection from n8n
  desc: Detects n8n container making connections to non-whitelisted IPs
  condition: >
    container.name = "svc-automation" and
    evt.type in (connect) and
    fd.typechar = "4" and
    not fd.rip in (rfc_1918_addresses)
  output: >
    Suspicious outbound connection from n8n
    (connection=%fd.name container=%container.name image=%container.image.repository)
  priority: WARNING
  tags: [network, n8n, lateral_movement]

Rule Breakdown

condition Scopes the rule to the svc-automation container only. Prevents false positives from other services. Monitors connect() syscalls caught by Falco eBPF.

fd.typechar Filters for IPv4 connections only ("4"). Combined with not fd.rip in rfc_1918_addresses. Any connection leaving the private network space triggers the alert.

output Structured output captures connection tuple, container name, and image. Shipped through Falcosidekick to SIEM dashboards and Telegram alerts for real-time SOC visibility.

tags Tagged lateral_movement. Aligns with MITRE ATT&CK T1571 (Non-Standard Port) and T1041 (Exfiltration Over C2). Enables automated SIEM correlation; alert routing is moving from Datadog to Splunk HEC.

Interactive // AI Deployment Decision Tree

Based on the AI Governance Policy (ISO 42001 • ISO 27701 • NIST AI RMF)

Does the AI system process, store, or have access to personal data (PII)?

// Governance, Risk & Compliance

GRC at a Glance

57 Documents

28,000+ lines of compliance documentation

NIST SP 800-53 MAPPED • 133 controls / 16 families

CIS Controls MAPPED • Risk Register

ISO 42001 / 27701 MAPPED • AI Governance

NIST AI RMF MAPPED • Risk Management

HIPAA Security Rule CROSSWALK • ePHI Handling

SOC 2 / ISO 27001 CROSSWALK • Trust Services Criteria

FedRAMP Moderate INHERITED • via NIST 800-53

Self-assessed against NIST SP 800-53 Rev 5 Moderate baseline

▶ View GRC Library on GitHub →

Control Implementation Status

Implementation Coverage

Identity & Access92%

Teleport + Keycloak + Vault

Network Security95%

Cloudflare Tunnel, zero exposed ports

Detection & Response88%

Falco + Falcosidekick + n8n SOAR pipeline

Data Protection85%

Encryption at rest, local AI processing

Compliance90%

57 GRC docs, 133 NIST controls

CI/CD Security94%

Gitleaks + Trivy + Semgrep + Cosign

NIST 800-53 Coverage by Family

Access Control

Audit & Accountability

Identification & Auth

Incident Response

Config Management

Risk Assessment

System & Comms

System & Info Integrity

Assessment & Authorization

Contingency Planning

System & Services Acq

Planning

Physical & Environmental

Personnel Security

Media Protection

Maintenance

High (>80%) Medium (40–80%) Low (<40%)

Key Deliverables

System Security Plan (SSP)

NIST 800-53 • 133 controls • 16 families

View on GitHub →

POA&M + Risk Assessment

42 findings • 17 threats • MITRE ATT&CK mapped

View on GitHub →

10 Security Policies

Including AI Governance (ISO 42001 + 27701 + NIST AI RMF)

View on GitHub →

5 IR Playbooks + Tabletop Exercise

Compromised container, DDoS, leaked credential, unauthorized access, AI system compromise

View on GitHub →

8 OPA/Rego Policies

Infrastructure enforcement • CI pipeline • Pre-commit hooks

View on GitHub →

Threat Modeling Suite

STRIDE (29 threats, 7 trust boundaries) • AI Threat Catalog • Attack trees • Squire threat model

View on GitHub →

AI Governance Engineering

Agent signing • AI audit trail spec • Supply chain register • OWASP MCP Top 10 audit • HITL policy

View on GitHub →

Red Team + Pen Test Results

20 test cases across OWASP LLM01, LLM06, LLM09 • Zero injection bypasses • Pen test self-assessment

View on GitHub →

IR Playbook // Compromised Container

TRIGGER

Container anomaly detected by Falco

Falco eBPF detects syscall anomaly or unexpected outbound connection. Alert routed via Falcosidekick to the SIEM and Telegram within seconds. Incident timer starts.

▼

DECISION

Is the container internet-facing?

Check Cloudflare Tunnel routing table and Docker network config. Internet-facing: any container with tunnel ingress or exposed port. Non-internet-facing: internal bridge network only.

▼

YES // Isolate

ACTION

Isolate immediately (network disconnect)

Docker network disconnect to cut external access. Block Cloudflare tunnel route. Preserve container state. Do NOT stop or remove. Log isolation timestamp for SLA tracking.

NO // Assess

ACTION

Assess blast radius

Review Docker network topology. Identify containers on same bridge network. Check shared volumes. Assess if internal service credentials are in scope. Correlate with Datadog alerts.

▼

FORENSICS

Capture snapshot + analyze Falco audit logs

Docker export for filesystem snapshot. Teleport session recordings capture any interactive access. Pull Falco audit trail from Datadog. Preserve evidence before remediation.

▼

REMEDIATION

Rebuild from clean image

Pull fresh image from registry. Redeploy via Docker Compose with clean volume mount. Rotate any secrets that may have been exposed (Vault credential rotation). Verify all services healthy.

▼

Update detection rules • Document lessons learned

Post-incident review within 48 hours. Update Falco rules to close detection gap. Document in POA&M. File entry in GRC risk register. Close incident ticket with RCA summary.

Click any node to expand details

// Writing

Blog

Short notes on AI security, GRC, and building things. Full feed on LinkedIn.

POST • 96K IMPRESSIONS

The cert cycle: why my certs alone never got me a callback

POST • 33K IMPRESSIONS

"What have you built?" The question that goes silent

POST • 20K IMPRESSIONS

The certs debate: the people getting hired stopped having it

Contact

Preferred

etigoue@tigouetheory.com

Response time: under 24 hours

Professional Networks

LINKEDIN linkedin.com/in/emmanuel-tigoue GITHUB github.com/ET-sec PORTFOLIO et-sec.github.io/portfolio RESUME Download PDF

Current Status

OPEN TO OPPORTUNITIES

LOCATION

Atlanta, GA

Open to relocation

CLEARANCE

Eligible

Download Resume

◉ EMMANUEL TIGOUE

Certifications

ISC2 CISSP

AWS Security Specialty

CompTIA SecurityX

ISC2 SSCP

Cisco CCNA

CompTIA Security+

ISC2 CC

CompTIA Network+

Experience

Education

What I Built

$135/mo

Multi-Cloud IaC

$0/mo

4-Layer Security Architecture

$135/mo to $0: Multi-Cloud IaC

14-Workflow SOAR Orchestration

Security Engineering

AI Security & Governance

ISO 42001

ISO 27701

NIST AI RMF

GRC at a Glance

Blog

Contact

ISC² CISSP

ISC² SSCP

ISC² CC