I’m Gustavo Aragón, founder of Oktsec. I work on AI governance, security assessments and controls for agents using business tools and data. My work brings together research, open source software and more than 20 years building technology companies and products.
ACROSS THE REGION
I’m meeting companies, universities and institutions across the region to discuss cybersecurity and AI adoption. Colombia and Panama are part of that work: understanding their needs, sharing experience and exploring how we can work together.
COLOMBIA · OCTOBER 2026
At ACE Barranquilla, an OAS initiative, I received the award from Leandro Rizzuto, the U.S. Ambassador to the organization.
Signed with people and organizations to explore cybersecurity, AI and training projects. The scope of each collaboration is agreed through follow-up.
Read about the awardAmericas Competitiveness Exchange
Organizers and supporting institutions of ACE Barranquilla 2026
PANAMA · BUSINESS & UNIVERSITIES
In Panama, I met companies adopting AI and visited FIEC at the invitation of Dean Gustavo Díaz. We discussed security, governance and future academic initiatives with Oktsec.
The meetings in PanamaNEXT VISIT · NOVEMBER 16–20
I plan to return to Universidad de Panamá for a talk and workshops with students. The program will be defined with the faculty around the group’s experience. Session dates and registration remain to be confirmed.
The collaboration with FIECTALKS · WORKSHOPS · TRAINING
Talks and training for companies and universities across Latin America. I bring cases from security research, building products and founding companies to help people understand risks, make decisions and develop technical skills.
EXPLORE TALKS & TRAININGHow AI changes attacks, what connected agents can access and where people entering the field can begin. Cases and questions, with no prior security knowledge required for an introductory talk.
Who authorizes an agent, which data it may use and what needs human review. For business, technology and public sector teams deciding how to use AI responsibly.
Lessons from co-founding Brelo in Brazil, developing patented technology for phone-backed credit and building Oktsec. Customer problems, product choices and the responsibilities of a technical founder.
EXPERTISE / 01
Identity, delegated permissions, tool execution, package provenance and the infrastructure paths that connect them.
How agents are attacked through their own tools, MCP servers, delegated authority and credentials.
Confirmed findings across agent tooling, developer CLIs, packages and cloud infrastructure.
Runtime governance, verifiable evidence and open source controls built for the agent ecosystem.
FIELD RESEARCH / 02
Confirmed issues across agent tooling, developer CLIs, packages, OAuth providers and cloud infrastructure.
VRP / MSRC / HackerOne / direct disclosure
Reports across A2A and gemini-cli, plus a confirmed remote-code-execution path in ax.
PRODUCTS, PROTOTYPES & OPEN SOURCE / 03
Security products, open source tools and a prototype for following up on institutional collaboration.
Security infrastructure for AI agent work. Test consequential workflows, inspect dependencies, enforce policy before routed actions run and preserve evidence for review.
02A scoped security assessment for agent workflows, MCP servers, applications and automation paths, with reproducible findings, remediation priorities and retesting.
03An open source security engine that checks packages, lockfiles, install scripts, MCP configurations, skills and tools before trust is granted.
04A local delivery workflow for AI coding agents: scope, plan, build, review, security, QA and ship, with evidence left on disk.
An independent prototype developed after ACE Barranquilla, an OAS initiative. It organizes follow-up on letters of intent through shared stages, progress notes and an activity history.
BLOG / 04
Notes on protocols, vulnerabilities and product decisions, with links to the underlying sources.
Sysdig documented what it assesses as the first agentic ransomware operation. The exploit chain was familiar; the adaptive loop and compressed response window were not.
03Production agents usually operate with approval, supervision or guardrails. Each step away from the human changes the requirements for identity, policy, evidence and recovery.
EXTERNAL CREDENTIALS / 05
Anthropic validation for leading Claude Code implementations in organizations, from scoping and architecture through deployment, security, governance and adoption.
Gustavo Aragón has been approved for individual access to OpenAI Daybreak Blue for authorized defensive security research. This access supports his research and development work on Oktsec.
ABOUT / 06
Cybersecurity was one of the first disciplines I worked in. I later expanded into product, fintech and regulated infrastructure without leaving security behind. Today those paths converge in Oktsec.
CONTACT
Tell me about a security assessment, an AI governance decision or a talk for your organization. Include the context and what you need to achieve.
OR EMAIL DIRECTLYgus@oktsec.com