Swordfish Security Publishes PRO DevSecOps Conf 2026 Talks on AI System Security

Three weeks after the conference, Swordfish Security has opened the recordings of PRO DevSecOps Conf 2026. The event took place on September 22 and is the group's annual forum on secure development and secure AI. The videos are available in a RUTUBE playlist, and the announcement was published on Habr on October 13. The organizers state their motivation plainly: AI reaches production faster than teams can build defenses around it. Add the regulatory backdrop: they say Russia already has 243-FZ on AI in force, and requirements for secure development are growing.

What we know about the event

The announcement is short. It lists no speakers or topics, so summarizing the talks would mean making things up. Here is what the text confirms:

• organizer: Swordfish Security group of companies;
• format: the annual PRO DevSecOps Conf, 2026 edition;
• date: September 22;
• topics: secure development (DevSecOps) and secure AI;
• where to watch: a RUTUBE playlist, linked from the Habr post;
• regulatory context: 243-FZ on AI, as the organizers describe it.

Putting the two topics in one program shows how the profession's agenda is changing. Security teams used to look at code and dependencies. Now models, datasets, prompts and agents are inside the perimeter too.

Why AI complicates the development pipeline

Classic DevSecOps is built around well-understood artifacts: source code, containers, libraries, infrastructure code. These have static and dynamic analysis, dependency scanners and SBOMs. AI components bring new attack surfaces.

First: prompt injection. An LLM-based application takes in text from untrusted sources, whether emails, web pages or documents in a RAG store. The model does not separate data from instructions the way a parser does, so a malicious command can take effect. OWASP maintains a separate list of risks for LLM applications, and injection remains among the key ones.

Second: the model supply chain. Weights are downloaded from public repositories, and some serialization formats, such as pickle, can execute code on load. This is the same risk as an unknown library, but it is checked far less often.

Third: agents. Once a model gets access to tools, email, a database or CI, a mistake or an attack stops being a wrong answer and becomes a real action with real privileges.

Regulation as an accelerator

The organizers mention 243-FZ on AI. The announcement does not say what the law requires of developers, and the exact provisions are worth checking in the primary source rather than in retellings. The logic itself is clear: once AI systems fall under formal requirements, security stops being an enthusiasts' initiative within a team and becomes an item on a compliance checklist. For companies that operate in Russia and already comply with secure development requirements, this means they need to document how they verify the AI part of their product as well.

Where a team can start

The conference recordings are a good reason to run an internal review. Here is a minimal set of steps, not tied to any specific talk:

• build a registry of all AI components: external APIs, local models, RAG stores, agents and their privileges;
• extend dependency tracking to models and datasets: source, version, format, checksum;
• prohibit loading weights in unsafe formats without isolated verification;
• add prompt injection and context leakage tests to CI as a separate class of checks;
• give agents minimal privileges and log every action they take with tools;
• assign an owner who will map the requirements of 243-FZ to current processes.

After that, it makes sense to open the playlist and pick talks that fit your stack. Until the program is published as a separate list, you will have to go by the video titles on RUTUBE.