DSOLG October Event

Details

Welcome to the DevSecOps London Gathering October Event on Wednesday 28 October! We bring you another night of great speakers, as well as the usual conversations, pizza and beer!

📍 Hosted at Autogen AI, 123 Pentonville Road, London, N1 9LG
📅 Wednesday, 28 October 2026
🕕 6:00–8:00 PM

Talk Abstracts:

Talk 1 - Intent Graphs by Daramola Benjamin
An AI agent executing a task is filling in fields the user never specified. Book a flight to Dubai on Emirates, window seat, and cabin class, baggage, and refundability are all left open by default, not by choice. Sometimes the agent fills that gap with excess authority, a security failure. Sometimes it fills it with a wrong default, a correction failure. Both come from the same missing distinction.
This talk shows, from primary sources, where current standards stop. Web Bot Auth proves which agent sent a request but explicitly excludes the end user from its scope. RFC 8693 token exchange records a delegation chain but has no mechanism for capturing consent. Neither has an object for what a task actually was, which is a schema gap, not a cryptography gap.
The Intent Graph closes it: a shared schema where every task field is tagged declared or open dependency between fields is explicit, and revoking a permission or correcting a wrong outcome are the same graph operation at different points in time. The correction mechanism, causal scoping compensation, and an append only log, is walked through a flight booking where a wrong cabin class gets refunded and rebooked without touching the seat, the dates, or anything else that was already right.

The talk closes on the harder case: a structural material substitution and a surgical tool approaching an exclusion zone, where correction arrives too late to matter. One rule, the correction window of a field against the system's detection and response latency, decides whether the right response is fail open and correct after, or fail closed and verify before.
Speaker Bio:
Daramola Benjamin is an applied economist and engineer, and Head of Engineering at Levered. His current work is the Intent Graph, a schema and system architecture for identity, delegation, and correction in AI agent systems, closing the gap between what today's standards secure and what autonomous agents actually need. This work has produced a full system architecture, a research paper, a published technical analysis of agentic identity and permissioning, and a competitive review of the space. He has spoken on the Intent Graph at Practically AI, Manchester. Daramola designs systems and builds product end to end, with a background spanning fintech, commerce, and SaaS that shaped how he approaches identity and delegation as a systems problem with real consequences when it goes wrong.

Talk 2 - You’ve Generated Your SBOM. Now What? by Viktor Petersson
The EU Cyber Resilience Act (CRA) makes Software Bills of Materials (SBOMs) a requirement for products in scope. Many teams are still tackling generation, but that is only the beginning. Real products contain multiple components, each with its own SBOM. Understanding what shipped means linking those SBOMs to specific releases and keeping that history useful for years.
Viktor Petersson co-led the CISA working group on SBOM generation. This talk starts with SBOM 101 and introduces sbomify-action, an open source, opinionated implementation of the blueprint developed by that group for generating high-quality SBOMs in CI/CD.
We then explore what happens after generation: retaining SBOMs, tracking components across releases, and putting the CRA’s ongoing vulnerability-handling requirements into practice. We’ll cover monitoring CVEs, prioritising findings using CISA’s Known Exploited Vulnerabilities (KEV) catalogue and Exploit Prediction Scoring System (EPSS), and communicating product impact through Vulnerability Exploitability eXchange (VEX).
Using the open source sbomify platform (github.com/sbomify/sbomify), we’ll show how to bring these workflows together, from organising SBOMs by product and release to managing vulnerability findings. Attendees will leave with a practical path from generating an SBOM to maintaining an actionable inventory of what they ship.
Speaker Bio:
Viktor Petersson is the founder of sbomify, a platform for streamlined SBOM management and compliance, and co-founder of Screenly, a secure digital signage company trusted by NASA, Capital One, and others. His background spans developer tools, open source, and security-focused startups, with a track record of building products used at scale.
Links:
LinkedIn - https://www.linkedin.com/in/vpetersson/
GitHub - https://github.com/vpetersson
X - twitter.com/vpetersson
Website - https://vpetersson.com/
Nerding Out with Viktor Podcast - https://vpetersson.com/podcast/
Screenly - https://www.screenly.io/
Sbomify - https://sbomify.com/