Security Scanning Security Hardening

What it does

This skill enables AI agents to implement a comprehensive security hardening program using a defense-in-depth strategy and coordinated multi-agent orchestration. It performs vulnerability scanning, threat modeling, architecture security reviews, and implements layered security controls across application layers, infrastructure, and CI/CD pipelines. The process follows DevSecOps principles with automated scanning and compliance validation to create a resilient security posture.

When to use it

• Running a coordinated security hardening program.
• Establishing defense-in-depth controls across applications, infrastructure, and the CI/CD pipeline.
• Prioritizing remediation efforts based on scan results and threat modeling.

Key capabilities

• Comprehensive Security Assessment (Phase 1): Includes vulnerability scanning (SAST, DAST, dependency audit, secrets detection), SBOM generation, identification of OWASP Top 10 vulnerabilities, CWE weaknesses, and CVE exposures.
• Threat Modeling & Risk Analysis (Phase 2): Uses the STRIDE methodology to analyze attack vectors, assess business impact, and prioritize risks based on likelihood and impact. Maps threats to the MITRE ATT&CK framework.
• Architecture Security Review (Phase 3): Evaluates service boundaries, data flow security, authentication/authorization architecture, encryption implementation, and network segmentation.
• Multi-agent orchestration: Coordinates specialized agents for assessments and remediation.

Example prompts

• "Perform comprehensive security assessment on the web application located at [application URL]."
• "Conduct threat modeling using STRIDE methodology for the payment processing service."
• "Review architecture for security weaknesses in the microservices backend."

Tips & gotchas

• Sequential Execution: This skill is designed to be executed in phases (1-4). Start with Phase 1 to establish a baseline.
• Authorization Required: Ensure you have authorization for security testing and making changes to the environment.
• Rollback Plans: Always ensure rollback plans are in place before applying hardening changes.