OWASP guidance for agentic applications

Self-hosting an open-weight model transfers six security jobs to the buyer

Versa field CISO Prasad Tharippala says in-house inference buys control and data residency, but security has to be built rather than assumed. For a team with 90 days and no money, he puts agent inventory and blast-radius work first.