How to Secure AI Systems and the Development Pipeline: PRO DevSecOps Conf 2026 Talks

More than 30 information security, DevOps, and AI experts gathered at PRO DevSecOps Conf 2026. The event took place on September 22 against a backdrop of rising regulatory pressure: Russia's federal law 243-FZ on supporting artificial intelligence technologies is now in effect, and regulatory requirements are outpacing company practices.

The central problem: AI is reaching production far faster than teams can build a security framework around it. The solution is to embed security into every stage of the lifecycle — from model development and integration with corporate systems to monitoring in live production.

A New AI Security Maturity Model: SAIMM v2.0

The conference's headline announcement was the presentation of SAIMM v2.0 (Secure AI Maturity Model). This updated version of the model accounts for both the specifics of AI development and Russian regulatory requirements. The model lets an organization assess its readiness for secure development and operation of AI systems. PJSC VimpelCom has already run this assessment and turned the results into a concrete risk-reduction plan. The results helped the company scale its secure development process across 90+ teams and 200+ products.

Protecting the Supply Chain and AI Models

A separate focus was supply chain security in the context of AI development. Speakers discussed trusted software supply chains, protection against reverse engineering, and preparation for a new GOST standard on secure development environments. AppSec Solutions presented tools for defense at every stage:

• AppSec.Track — supply chain protection, tracking code written by AI agents • AppSec.Code — static analysis of vulnerabilities in source code, accelerated by AI • AppSec.Registry — protection for dependency and artifact registries • AppSec.GenAI and AppSec.AIGate — protecting AI models at every stage, from development to live use in integrated systems • AppSec.Sting — dynamic testing of mobile applications at the speed of AI-driven development • AppSec.Cryptex — protecting mobile applications against reverse engineering and tampering • AppSec.Wave and AppSec.Hub — SAST and ASPM (Application Security Posture Management) tools adapted for the age of AI-generated code: vulnerability detection is already automated, so the bottleneck has shifted to triaging the findings

Shadow AI and Controlling AI Tools

A paradox: corporate bans on ChatGPT, Claude, and similar tools simply don't work. The right approach is to give employees a convenient, controlled tool instead. This prevents leaks through public services and provides visibility into which AI systems are actually being used in development.

Recordings of all talks are available on RUTUBE. Speakers included: Alexander Pinaev, Yuri Sergeev (Swordfish Security), Oscar Konyukhov (Fyodor Konyukhov Expeditions), Albina Askerova, Dmitry Sluzhenikin (AI Consortium), Anton Basharin, Alexander Gaday, Andrey Orekhov, Denis Danilov, Evgeny Kulikov, Pavel Toshchakov, David Kim (Swordfish Security), Kirill Sorokin (VimpelCom), Roman Shapiro (Russian Post), Konstantin Bragin, Yuri Shabalin, Mikhail Makarov, Danil Balavnev (AppSec Solutions), Nikita Pinaev, Alexander Zavodovsky, Kirill Garanov.