Threatspotting

Cyber Risk & Security Services

Threatspotting Ltd provides cyber risk and security services to organisations around the globe from our office in Budapest, Hungary.Our services help you:

Our philosophy is threat-centric and our approach is pragmatic. We start by learning your cyber concerns and how that has driven your handling of cyber risk to date. We learn about your business, plans, capabilities and constraints, and then we assess and prioritise the threats you face and help you manage them.Our advice is battle tested and fully independent.

Our Expertise

We have significant expertise and experience in directly addressing key cyber challenges:

The scope of our engagement could be a specific high risk business process or your enterprise as a whole.

"Tactics is knowing what to do when there is something to do; strategy is knowing what to do when there is nothing to do."- Savielly Tartakower, International Chess Grandmaster

Get in Touch

Threatspotting Kft. Company #01-09-384530. Registered office: 1112 Budapest, Brassó út 19, Hungary
Terms of Service & Privacy Policy © Threatspotting Kft. 2021-2025

Workshop: Pair Programming with Aider to Create High‑Performance Web Security Tools

Overview

This half-day workshop - originally given at BSides BUD 2025 - is designed to help attendees rapidly prototype and build practical security tools using Large Language Models (LLMs) as coding partners. The session demystifies how to harness LLMs - specifically via the open-source terminal-native tool Aider - to develop robust, production-ready Python APIs for real-world security use cases.Participants will build a Python FastAPI-based microservice that transforms raw security signals (such as HTTP response headers and open ports) into actionable intelligence, guided by LLM-powered analysis. The workshop is hands-on, with each segment focused on solving a specific technical challenge that security reseachers and practitioners face in tool development. It covers:LLM-Driven Development Workflow:
Attendees will learn a repeatable workflow for collaborating with LLMs, using Aider to structure ideas, generate and review code, and iterate safely under version control. This includes prompt engineering, managing LLM hallucinations, and overcoming knowledge cut-off issues.Building a Secure FastAPI Service:
The workshop walks through scaffolding a FastAPI application with endpoints for health checks and security analysis. Participants will implement logic to fetch and process HTTP headers from a target URL, optionally enrich results with port scan data, and compose structured prompts for the LLM to prioritise risks and recommend mitigations.Security Hardening and Testing:
We address common pitfalls in LLM-generated code, such as insecure defaults and missing validation. Attendees will add input validation (Pydantic models), API key authentication, and basic automated tests (pytest), ensuring the resulting tool is safe for enterprise environments.AI-Augmented Security Reasoning:
The workshop demonstrates how LLMs can add contextual judgement to otherwise basic scripts, turning raw scan results into prioritised, actionable findings for defenders. We discuss strategies for verifying LLM output, integrating static analysis (e.g., Semgrep), and keeping code and documentation in sync.Practical DevOps & Deployment:
The session concludes with a discussion on extending and operationalising the tool: async refactoring, Docker packaging, CI/CD integration, and ideas for enterprise features such as RBAC and alerting.By the end of the workshop, participants will have:
- A working FastAPI microservice that leverages LLMs for security analysis.
- A clear, practical workflow for pair programming with Aider and LLMs.
- Experience hardening and testing AI-generated code for real-world use.
- A foundation for extending the tool for their own environments and use cases.The workshop is suitable for anyone with basic scripting experience. All code and setup instructions are provided, with a focus on hands-on learning and immediate practical outcomes.

Agenda (3 hours)

From Your Instructor

A chance reading of The Cuckoo’s Egg first sparked my interest in cybersecurity.Motivated by the story, I began testing the defences of the UNIX systems I managed (from a converted horse stable) - starting a journey with no finish line.Curiosity became a career as I explored every layer of enterprise security. Highlights include serving as Group Security CTO for Barclays PLC, leading the original GE Red Team, and driving technical security at GE Money.These roles gave me a front-row seat to the realities of defending large organisations, where theory collides with messy day-to-day challenges. I’ve tackled everything from persistent threats and digital banking fraud to insecure legacy infrastructure, learning what works - and what doesn’t.Today, through my consultancy Threatspotting I advise CISOs facing unique security challenges, guide tech startups to ISO 27001 and teach security pros how to leverage AI.

Logistics & Pricing

This workshop is delivered on-site and in person at your premises. You provide: a suitable room, Wi-Fi, projector (beamer), tables for attendees and instructor and a suitable number of power outlets.All presented workshop materials will be shared with attendees at the conclusion of the workshop.Standard Fee
€5,000 per session, payable upon booking confirmation, plus reasonable travel and (if required) lodging expenses.
Maximum class size: 20 attendees per session.If payment is not received within 7 working days of provisional booking, the reserved dates may be released and offered to other clients.Once a booking is confirmed, fees are non-refundable except in the rare event that I am unable to deliver the workshop as agreed (e.g., due to illness or emergency).No Workshop Fee for Hungarian Not-for-Profit Higher Education Institutions
This workshop is offered free of charge to not-for-profit higher education institutions within Hungary, with capacity for up to 50 accredited students per session. Please note that this offer is intended exclusively for bona fide students of these institutions; sponsoring companies or external organisations are asked to arrange paid sessions.I kindly request reimbursement for reasonable travel costs from Budapest, as well as provision of lunch and refreshments. Please ensure that the workshop schedule allows sufficient time for same-day travel to and from Budapest, so that overnight stays are not required.Attendee Requirements
No advanced programming skills required - this workshop is designed for casual coders and anyone keen to improve their confidence with code, regardless of experience level.
All participants are asked to bring a laptop with Python pre-installed (Aider compatible versions: 3.8-3.13).Contact me to ask questions, check availability and book your workshop.