Capability ยท Security

Building AI software is easy now. Getting it trusted is the work.

Any team can build an AI app in a week. Getting it past a security review, a platform assessment and a customer's due diligence is the hard part. I prepare AI software for that: gap reviews against OWASP and Google's CASA requirements, authenticated security scans, MFA and session controls, and the policies and controls a SOC 2 readiness review expects.

I do this work as AI & Automation Lead at Dexterous Group in Melbourne. This page shows the capability; it is not an offer of personal services.

How I approach it

The method, step by step.

  1. Start from the assessor's list

    Map the app against the requirements it will be judged on (OWASP ASVS, Google CASA, a customer's questionnaire) before the next feature, and record every gap with an owner.

  2. Test like an attacker would

    Authenticated dynamic scans of the real application, then fix and rescan until the findings are closed, with the evidence kept.

  3. Controls people can see

    MFA, session revocation, TLS everywhere, least-privilege access and logging that answers "who did what".

  4. Write the policies once, properly

    Information security policy, data classification, risk register, incident response and a tabletop exercise: the documents an auditor and a customer ask for.

Work

Where I have done it.

Anonymised: no client, employer product or confidential detail.

Problem
An AI platform reading business email needed restricted Google scopes, which require a CASA security assessment.
What I did
Gap review against the CASA requirements, authenticated OWASP ZAP scans, MFA, session revocation and TLS hardening.
Result
A documented control set and scan evidence ready for the assessor.
Stack
AWS ECS and RDS, OpenTofu, GitHub Actions, OWASP ZAP
Problem
A growing software business needed the security paperwork customers ask for.
What I did
Wrote the information security policy, data classification standard, cyber risk assessment, privacy pack and AI risk register, plus a SOC 2 readiness control set.
Result
Policies, a control matrix and an incident response plan in place before the audit conversation.
Stack
SOC 2 Trust Services Criteria, ISO 27001 practices
Tools and standards

What I work with.

  • Google CASA
  • OWASP ASVS and ZAP
  • SOC 2 readiness
  • ISO 27001 practices
  • MFA and session controls
  • ACS Certified Professional (Cyber Security)
  • EC-Council ADG
Questions

Frequently asked.

What is a Google CASA assessment?

CASA (Cloud Application Security Assessment) is the security review Google requires for apps that request restricted scopes, such as reading Gmail. It is based on OWASP ASVS and checks authentication, data protection, secure configuration and how the app stores user data.

Is SOC 2 required in Australia?

No law requires it, but many customers, especially in the United States and larger Australian enterprises, ask SaaS suppliers for a SOC 2 report or equivalent evidence. Readiness work (policies, controls and evidence) comes before the audit itself.

What is the difference between a security scan and a penetration test?

A scan uses tools to find known weaknesses automatically. A penetration test is a person trying to break in, chaining weaknesses the way an attacker would. Assessments often need both, with the evidence of what was fixed.

Does Amjid Ali offer security assessments?

No. He does this work as AI & Automation Lead at Dexterous Group and writes about it here. For project work, contact Dexterous Group; for speaking or media, email mail@amjid.au.

Read more

Insights on this.

Other capabilities

Also on this site.

For project work, contact Dexterous Group. For speaking, media or a peer conversation, email mail@amjid.au or message me on LinkedIn.