Saying Foundry Safety Spec – Cisco Blogs

An Open Specification for Agentic Safety Analysis

Within the age of AI, the true recreation changer is greater than the most recent LLM, it’s how you set it to work. That’s why we’re open-sourcing the Foundry Safety Spec, a battle-tested blueprint for constructing an agentic safety analysis system. As a result of the framework is model-agnostic and stack-agnostic, organizations can construct a harness that matches their distinctive surroundings. In sharing what we’ve discovered, our purpose is to assist the group of defenders transfer sooner and smarter. It allows organizations to shift from noisy alerts to verifiable safety findings that drive affect.

The working mannequin of cybersecurity has basically shifted. As frontier AI fashions create a brand new dual-front problem, attackers are actually figuring out vulnerabilities at machine pace, leaving safety groups struggling to maintain tempo with guide, legacy processes. At Cisco, we acknowledge that the outdated “discover and patch” cycle is not enough to handle this new velocity of danger. Nonetheless, the true potential of those fashions is realized solely once we mix the appropriate harness – the brokers and orchestration – with the expert professionals who drive them. By transferring past incremental productiveness positive factors to rethink how we discover and repair vulnerabilities at scale, we’re introducing the Foundry Safety Spec as a crucial alternative to empower our groups and assist tip the scales in favor of the defenders. This work from Cisco is knowledgeable by classes discovered and capabilities developed by superior safety engineering efforts inside our inside safety staff.

Foundry Safety Spec is supposed for use with GitHub’s spec-kit, which is an industry-wide set of spec-driven improvement workflows that can be utilized with completely different AI brokers.

Foundry is printed as two principal artifacts, and a set of supporting paperwork:

• The “spec” artifact — eight core agent roles, 5 extension roles, the discovering lifecycle, the coordination substrate, and roughly 130 useful necessities, every with an inline rationale explaining why it exists.
• The “structure” artifact — eleven inviolable rules. Each one among them encodes an actual manufacturing failure we shipped, recognized, and stuck.

The Drawback Foundry Solves

Each safety staff with entry to a frontier LLM has tried the identical factor not less than as soon as: toss a repo on the mannequin and ask it to “discover the bugs.” The result’s often a wall of unbounded, unverifiable output that mixes sharp insights with hallucinated findings, with no technique to know what was missed or whenever you’re truly completed. A full agentic system like Foundry Safety Spec is the antidote to that chaos: it wraps the mannequin in orchestration, roles, and guardrails in order that detection, validation, and protection are designed up entrance as an alternative of improvised in a chat window. The distinction is stark—one is an fascinating demo; the opposite is a safety analysis system you possibly can defend in entrance of your CISO and your auditors.

Organizations are investing on AI-assisted safety and getting again hallucinated findings, false positives at scale, and no protection sign. Foundry Safety Spec is the scaffolding that turns a frontier LLM from “an fascinating demo towards your codebase” right into a safety analysis system that produces:

• A bounded, prioritized, verifiable set of findings.
• A transparent “completed” sign and the conjunction of an operator-defined protection ground and an financial yield threshold.
• An auditable provenance chain from detection by triage, validation, and publication.
• Security guardrails that assume the mannequin will, sooner or later, attempt to do the unsuitable factor; and constrain it on the substrate, not the immediate.

When you have a frontier LLM and software program you might be approved to judge, Foundry offers you the form of the system you want round it.

How Defenders Can Use Foundry Safety Spec to Take a look at Their Software program

Foundry is designed to be picked up and tailored, not consumed as-is. It’s the place to begin of your agentic safety analysis journey. The circulation seems like this:

1. The structure.md is learn by the AI agent (corresponding to Claude Code, Codex, or others) for use to construct the infrastructure. Nonetheless it is usually intentionally written as prose aimed on the human builder and maintainer, with every precept’s “Why that is inviolable” paragraph explaining the precise manufacturing failure that rule prevents, in order that when an engineer is tempted to weaken a precept for comfort, they encounter the price of that call earlier than they make it.
2. Run the seed by spec-kit. The specification is written to be consumed by spec-kit. The “seed” refers back to the preliminary, minimal setup that will get your spec‑pushed mission right into a recognized, prepared‑to-work state so AI brokers (or builders) can begin doing helpful work persistently.
3. AI agent builds the structure. The eight core roles (Orchestrator, Indexer, Cartographer, Detector, Triager, Validator, Protection-Information, Reporter) every have an outlined function, outlined inputs and outputs, and an inventory of useful necessities with rationale. You possibly can implement them as subprocess loops, as graph-based pipelines, as serverless capabilities, as a bespoke harness. The form is what transfers; the implementation is yours.
4. Pair Foundry Safety Spec with Challenge CodeGuard. Foundry Safety Spec’s Detector function consumes a corpus of LLM-evaluated detection guidelines. The foundations are from Challenge CodeGuardwhich Cisco open-sourced earlier than Foundry Safety Spec existed and donated it to the Coalition for Safe AI (CoSAI). The unique function of Challenge CodeGuard is to embed secure-by-default practices into AI coding agent workflows. It supplies complete safety guidelines and agent expertise that information AI coding brokers to generate safer code routinely. Nonetheless, it has additionally been very helpful for code overview and for autonomous safety evaluations and testing.

The self-improving detection-to-prevention flywheel:

1. CodeGuard guidelines sweep each operate in your goal: systematic, repeatable, finds what we already know to search for.
2. Foundry Safety Spec’s exploratory brokers hunt alongside: inventive, target-specific, finds what no rule but describes.
3. When exploration confirms one thing the principles missed, Foundry Safety Spec data a rule hole.
4. The hole is generalized into a brand new (or revised) CodeGuard rule and lands within the corpus.
5. The following sweep (on this goal and each future goal) catches that entire class on the primary move.
6. As a result of CodeGuard guidelines are transportable, the identical corpus masses into an LLM coding assistant as its secure-coding ruleset. The bug class your final analysis taught the corpus to detect is now prevented on the keystroke, in each developer’s editor, earlier than the subsequent analysis ever runs.

Each flip of the loop improves detection right here and prevention in every single place.

An amazing start line

We need to be very express about this: Foundry Safety Spec is a seed and a blueprint spec. It’s not a turnkey scanner or a single device. It’s an instance of what a sound AI-powered safety analysis system seems like. Your surroundings, your menace mannequin, and your targets will reshape elements of it. That’s by design. Each place the place the seed might both dictate a alternative or go away it open, we left it open and defined the trade-off.

Foundry Safety Spec is an open-source specification, not a managed service. As with every safety device, the accountability for implementation, oversight, and closing decision-making stays with the person. We offer the blueprint for the guardrails, but it surely’s as much as you to make sure that the ‘human-in-the-loop’ stays the ultimate arbiter of safety selections. We encourage customers to deal with this as a foundational part of their current safety governance program.

A standard query is whether or not this spec will turn into out of date as LLMs evolve. The reply is it was designed to not be. Foundry Safety Spec is constructed on useful necessities and roles, not particular mannequin parameters. Whether or not you might be utilizing in the present day’s frontier fashions or the extra complicated reasoning brokers of tomorrow, the necessity for an orchestrator, a detector, and a validator will stay fixed. The spec is designed to be the steady harness that retains your safety analysis constant, whatever the ‘engine’ underneath the hood.

Why a specification and never the supply?

Our inside implementations are tightly sure to Cisco infrastructure: our LLM gateway, our difficulty tracker, our personal cloud, and so on. Open sourcing that code would give defenders one thing that runs in precisely one surroundings. It might not switch.

What transfers is the design: which roles you want and why, what every should assure, how findings circulation from detection to publication, what “completed” means for an analysis, the place the standard gates go, and which shortcuts will harm you six months in. That design is mannequin agnostic and infrastructure-neutral.

A real contribution to the group

We don’t say this evenly: we consider this is without doubt one of the most substantive specs that may assist defenders check their surroundings and software program. It’s what safety groups attempting to make use of a frontier LLM responsibly are presently attempting to invent on their very own.

It pairs with CodeGuard to type an actual, working flywheel between detection (Foundry Safety Spec) and prevention (CodeGuard towards expertise in your developer’s coding agent). Each adoption strengthens the corpus. Each corpus replace raises the ground for everybody.

The safety of our international digital infrastructure is a collective effort. We invite you to discover the Foundry Safety Spec on GitHub, be a part of the dialog in our group boards, and start constructing your individual agentic safety analysis system. Go to our repository at https://github.com/CiscoDevNet/foundry-security-spec https://github.com/CiscoDevNet/foundry to get began in the present day.

Construct on it. Adapt it. Contribute to it.