rico@komenda
$ whoami

Rico Komenda

Senior Product Security Engineer. Application, cloud and AI security – breaking things to build them safer. Co-lead of the OWASP AI Security Verification Standard (AISVS), conference speaker and trainer.

About meTalksProjectsTraining
Rico Komenda logo: shield with RK monogram and padlock
./about

About

Who I am, what I work on, open-source contributions and publications.

open →
./talks

Talks

Conference talks from DEF CON to OWASP Global AppSec.

open →
./projects

Projects

AISVS, Agentic Chaos, DVAA and more open-source work.

open →
./training

Training

Workshops and trainings: OWASP Top 10, ethical hacking, AI security.

open →

Latest talks

all talks →
5–6 Nov2026
🇺🇸 OWASP Global AppSec USA 2026 · San Francisco
  • Hands-On AI Security Assessment with OWASP AISVS
    6 Nov · 10:30 · Workshop
    with Jim Manico
    The AISVS project leads walk through scoping an assessment, choosing verification levels and applying the requirements to LLM apps, agents and MCP-connected tools.
    Schedule
  • Security Chaos Engineering for AI Application Architectures
    5 Nov · 14:45 · Talk
    Applying chaos engineering to AI systems: experiments that mimic realistic failures and adversarial scenarios such as tampered data, prompt injection and degraded models.
    Schedule
  • OWASP AISVS: Bringing Order to AI Security Chaos
    5 Nov · 10:30 · Talk
    with Jim Manico
    Turning AI security into testable, verifiable requirements, and how teams can apply AISVS from design through production readiness.
    Schedule
29 Oct2026
🇺🇸 OWASP LASCON 2026 · Austin
Builders & Breakers Part II: Securing Agentic AI After the Death of LLM Wrappers
with Javan Rasokat
ScheduleConference

Open source

all projects →
AI Security Verification Standard

OWASP AISVS

A structured, testable checklist for verifying the security of AI-driven applications – covering models, data, agents and MCP. Rico co-leads the project with Jim Manico and others.

StandardOWASPCo-lead
ProjectDocs
Security chaos engineering for AI agents

Agentic Chaos

Inject reproducible faults – outages, latency, prompt injection, tool and memory poisoning, failing guardrails – and verify that your agent fails closed and your security invariants still hold.

PythonChaos engineeringAgents
GitHub
DVAA · Aria

damn-vulnerable-adversarial-agent

A Juice-Shop-style lab: a deliberately vulnerable bank assistant that demonstrates classifier evasion and fleet-wide blast-radius attacks against LLM agents with shared memory. Built for AI Agent Summit London.

PythonVulnerable by designLab
GitHub