MSManos Saratsisindromeas.hashnode.dev·1d ago · 8 min readNIST and AI-Written Code: The SSDF Gap and the New AI Agent StandardsOriginally published on the Dromeas blog. In short: NIST's SSDF (SP 800-218) still holds up on outcomes, but it assumes people write and review the code. With AI at 42% of committed code, the gaps are00
MSManos Saratsisindromeas.hashnode.dev·3d ago · 6 min readWhat Is AI SAST? How Agentic Code Review Differs From Pattern-Matching Static AnalysisOriginally published on the Dromeas blog. In short: classic SAST matches known-bad patterns, fast and repeatably. AI SAST adds reasoning about data flow and intent across files, which catches behavior00
MSManos Saratsisindromeas.hashnode.dev·3d ago · 5 min readISO 42001 for Engineering Teams: What It Actually Asks You to ProveOriginally published on the Dromeas blog. In short: ISO 42001 is a voluntary, certifiable standard for managing AI systems. For engineering teams it's mostly about evidence: showing how AI-assisted ch00
MSManos Saratsisindromeas.hashnode.dev·Sep 17 · 8 min readBehavioral Bugs Are Still Slipping Through AI Code Review. Here's What Actually Catches Them.Originally published on the Dromeas blog. The pull request looks clean, the linter's green, the tests pass — and the code still does the wrong thing the moment someone hands it an input nobody thought00
MSManos Saratsisindromeas.hashnode.dev·Sep 13 · 8 min readShadow AI in Your Codebase: The Governance Gap Most CISOs Haven't Mapped YetYour AI code governance policy probably covers the tools you approved. It says nothing about the ones your developers are actually using. That gap has a name now, shadow AI, and in 2026 it's stopped b00
