Ngesonto eledlule, ithimba le-Xygeni lalikhona I-OWASP Global AppSec EU 2026 eVienna, lapho Ochwepheshe bezokuphepha kwe-inthanethi abangaphezu kuka-800 babuthene e-Austria Center ngesikhumbuzo seminyaka engama-25 se-OWASP. Izinsuku ezimbili enkundleni yombukiso, izingxoxo eziningi no CISI-Os, abaholi be-AppSec, kanye nonjiniyela be-DevSecOps, kanye nesibonakaliso esisodwa esicacile: ukuvikela uchungechunge lokuhlinzekwa kwesofthiwe sekungene esigabeni esisha, futhi izinhlangano eziningi azikakulungeli lokho.
Nakhu esikubonile, esikubonisile, nalokho imboni esitshela khona.
Lokho Okwethulwe yi-OWASP eVienna
Isimemezelo esiyinhloko engqungqutheleni yalo nyaka sasithi I-OWASP AISVS 1.0, eyakhishwa ngoJuni 24, 2026, ngesikhathi somcimbi ngokwawo. standard iqukethe izidingo ezingu-514 ezingaqinisekiswa kuzo zonke izahluko ezingu-12 ezihlanganisa konke kusukela ekufakweni ngokushesha kuya ekuphepheni kwe-MCP. Ngokungafani nezinhlaka zokubusa ezifana ne-NIST AI RMF noma i-ISO/IEC 42001, zonke izidingo ze-AISVS zibhalwe ukuthi zihlolwe, ziphasiswe noma zehluleke. Kungukuqinisekiswa kokuphepha kokuqala okuqhutshwa umphakathi, okuvivinywayo. standard eyakhelwe izinhlelo ze-AI, eyenziwe ngendlela ye-OWASP ASVS, igolide standard ukuphepha kohlelo lokusebenza lwewebhu..
Ngale kwe-AISVS, ithrekhi yeseshini ibonise lapho ukunaka komphakathi kushintshe khona. Izingxoxo mayelana nokuphepha kwezinhlelo zokusebenza ze-ejensi, ukuphepha kwe-MCP, imikhuba yokunikezela ngesofthiwe evikelekile, ukutholwa kwe-AI yesithunzi, kanye nokuhlola izinhlelo zokusebenza ze-LLM ekukhiqizweni kwabusa isheduli. I-OWASP LLM Eziphezulu Eziyi-10, Izinhlelo Zokusebenza Eziphezulu Eziyi-10 Ze-Agency, kanye Nezinhlelo Zokusebenza Eziphezulu Eziyi-10 Ze-MCP azisaveli; zibukhoma standardlokho izinhlangano eziningi ezingakakwazi ukukuchaza ukuthi zichayeke kukho. IVienna yenze leso sikhala sabonakala.
Lokho i-Xygeni eyakubonisa eBooth G-08
Sisebenzise izinsuku ezimbili zengqungquthela ukukhombisa okuthile imboni eqhubeka ikucela kodwa okungajwayelekile ukukubona ngokoqobo: indlela yokuthola, ukuthola amaphuzu, kanye nokuphoqelela ukuphepha kulo lonke i-AI amaqembu akho ayisebenzisayo ukuthuthukisa, hhayi ikhodi abayikhiqizayo kuphela.
Ukuqala kwe-Xygeni AI Inventory eVienna kubonise indawo yonke yokuhlasela kwe-AI yenhlangano ebhalwe ngesikhathi sangempela, wonke amamodeli, i-ejenti, iseva ye-MCP, kanye nethuluzi lokubhala ikhodi le-AI, kanye nezikolo zobungozi, amagrafu obudlelwano, kanye ne- i-AI-BOM ethunyelwa ngaphandle ilungele abalawuli kanye enterprise abathengi. Kwabaningi abavakashela idokodo, kwakuyisikhathi sokuqala bebona indawo yabo yokuhlasela ye-AI iboniswa njengempahla ehlelekile, ehlolwayo.
I-AI Dependency Firewall ibonise ukuthi i-Shield ivimba iphakheji ye-npm enonya endaweni yokugcina yonjiniyela ngaphambi kokufaka, ngaphambi kokuba kube nesiginesha. Lokhu kuyindlela yokulawula uchungechunge lokuhlinzekwa kwesofthiwe oluvikelekile olusetshenziswa ngokwesiko. SCA amathuluzi angeke akwazi ukunikeza, ukutholwa okusebenzayo ngesikhathi sokulanda, hhayi ngemuva kokuthi iphakheji isivele isebenzisa iskripthi sayo se-postinstall.
Izingxoxo ezalandela ama-demo zazifana. Amaqembu amaningi awakwazanga ukuphendula umbuzo esikrinini: iphi i-AI ekhanda lakho SDLC?
Izinto Ezintathu Esizitshelwe Yi-Expo Floor
Ezingxoxweni eziningi edokodweni nasemaphasejini, kwavela izihloko ezintathu ngokuphindaphindiwe.
Ukuphepha kwe-MCP kuyindawo entsha yokungaboni
Ithimba ngalinye elisebenzisa abasizi bokubhala ikhodi ye-AI noma imisebenzi yokusebenza ye-ejenti linamaseva e-MCP abangakawafaki ngokugcwele ohlwini. Iningi lawo alinawo uhlu lwabavunyelwe, alinawo ukuqapha kokuziphatha, futhi alinawo ungqimba lokuphoqelela endaweni yokugcina yonjiniyela. Lokhu akuyona inkinga ebaluleke kakhulu, ama-5.5% amaseva e-MCP omphakathi aphethe amaphutha anobuthi bamathuluzi, kanti ama-43% aphethe ubuthakathaka bokufaka umyalo. I-ASVS 1.0 inikela isahluko sonke ezidingweni zokuphepha ze-MCP, futhi izingxoxo eVienna ziqinisekisile ukuthi yilapho igagasi elilandelayo lokuhlaselwa kwe-supply chain lizofika khona.
Umbuzo we-AI-BOM usuqala ukuba ngokoqobo
Abaholi bezokuphepha sebeqala ukuthola izicelo ezivela kubahloli bamabhuku kanye enterprise abathengi bempahla ye-AI efundeka ngomshini (amamodeli, amasethi edatha, ama-ejenti, amaseva e-MCP, namathuluzi okubhala ikhodi ye-AI) ngobudlelwano babo, amaphuzu obungozi, kanye nemephu yokulawula. Izinhlangano eziningi azikwazi ukukhiqiza eyodwa namuhla. I-AI-BOM isiba ngokushesha umlandeli wesikhathi se-AI SBOM, futhi izinhlangano ezingakhiqiza eyodwa uma kudingeka zizoba nenzuzo enkulu yokuthobela imithetho kanye nokuthembana njengoba kufika izibopho zokuhlolwa kwe-EU AI Act.
Uchungechunge lokuhlinzekwa kwesofthiwe oluvikelekile manje lusho ukuvikela ungqimba lwe-AI
Ukulawulwa kwe-supply chain yendabuko (SCA, SBOM isizukulwane, imvelaphi yokwakha, ubufakazi be-SLSA) zakhiwa ukuze kutholakale umhlaba lapho abantu babhala khona ikhodi futhi amaphakheji avela ezingosini zomphakathi. Ngo-2026, ama-ejenti e-AI commit ikhodi ngokuzimela, amaseva e-MCP enza izingcingo zamathuluzi egameni labasebenzisi, futhi amaphakheji anonya aklanywa ukuze aqondise ngqo ekusebenziseni amathuluzi e-AI. Isu elivikelekile lochungechunge lokuhlinzekwa kwesofthiwe elingambozi indawo yokuhlasela kwe-AI alisaphelele. IVienna yenze lokho kuvumelana kwabonakala kuzo zonke izinkundla zabathengisi, izingxoxo zeseshini, kanye nezingxoxo zasemgwaqweni ngokufanayo.
Lokho Esikuthathayo EVienna
I-OWASP Global AppSec EU 2026 kwakuyiphuzu eliwusizo lokulinganisa. Izingxoxo ezintathu ezenzeka kakhulu embukisweni (ukuphepha kwe-MCP, ukulungela i-AI-BOM, kanye nokuqinisekisa uchungechunge oluphelele lokuhlinzekwa kwesofthiwe endaweni ye-AI SDLC) yizingxoxo i-Xygeni eyakhelwe zona.
I-Zero Trust yafinyelela kunethiwekhi, ifu, kanye nobunikazi eminyakeni edlule. Umjikelezo wokuphila kokuthuthukiswa kwesofthiwe ungqimba olungakambozwa ngokugcwele. Njengoba ikhodi ekhiqizwe yi-AI manje ihlanganisa u-40% commitezinhlanganweni eziholayo, kanye nokusebenza kwe-ejensi okwandisa indawo yokuhlasela ngokushesha kunokuba amathuluzi endabuko e-AppSec angajwayela, lelo gebe liba yinselele eyinhloko yamaqembu okuphepha engxenyeni yesibili ka-2026.
Uma uphuthelwe yiVienna futhi ufuna ukubona lokho esikubonisile eBooth G-08, kunezindlela ezimbili zokujula: thatha i-a uhambo lomkhiqizo ukubona ipulatifomu isebenza, noma bhuka incwadi, futhi sizokukhombisa lokho esikubonisile embukisweni.
Imibuzo Evame Ukubuzwa
Kuyini i-OWASP AISVS?
Ukuqinisekiswa Kokuphepha kwe-AI (OWASP AIVS) Standard) ukuqinisekiswa kokuphepha kokuqala okuqhutshwa umphakathi, okungahlolwa standard Yakhelwe izinhlelo ze-AI ngenhloso. Yakhishwa ngoJuni 2026 kwa-OWASP Global AppSec EU Vienna, iqukethe izidingo ezingu-514 ezingaqinisekiswa kuzo zonke izahluko ezingu-12, ezihlanganisa ubuqotho bedatha yokuqeqeshwa, ukufakwa okusheshayo, ukuphepha kwe-MCP, ukuhlelwa kwe-ejenti, uchungechunge lokuhlinzeka, nokuningi. Ngokungafani nezinhlaka zokubusa, yonke imfuneko ibhalwe ukuthi ihlolwe ukuthi iyaphumelela noma iyahluleka.
Iyini i-software supply chain evikelekile ngo-2026?
Uchungechunge lokuhlinzekwa kwesofthiwe oluphephile ngo-2026 alusho ukuvikela kuphela ukuncika komthombo ovulekile, CI/CD pipelines, futhi bakhe izinto zobuciko, kodwa futhi namamodeli e-AI, ama-ejenti, amaseva e-MCP, namathuluzi okubhala ikhodi ye-AI manje afakwe kuzo zonke izigaba zokuthuthukiswa kwesofthiwe. Njengama-ejenti e-AI commit amakhodi ngokuzimela kanye namaphakheji anonya agxila kakhulu ekusebenziseni amathuluzi e-AI, ukuphepha kochungechunge lokuhlinzekwa kukhule ukuze kufake phakathi umjikelezo wokuphila wokuthuthukiswa kwama-ejenti.
