GenAI Security: 99% Is Not Protection

Evgeny was born and schooled in Tutaev, a small town in the Yaroslavl region built around a single factory, and then read applied mathematics at Demidov University in Yaroslavl. The internet came on prepaid cards then, and his dormitory predecessors left him Solaris manuals from the nineties that meant nothing to him as a developer. His first paid job was designing business cards: the local funeral home learned he was studying programming and ordered software for 5,000 roubles, its director hoping to save on 1C — he lost half a year and bought 1C anyway, and the lesson, Evgeny says, was for both of them. His internship began at a small firm where the accountants onboarded him and showed him a trainee desk between the toilet and a cupboard: nobody came near him for two days, though he saw three linked monitors on the chief programmer's desk, and on the third day he did not turn up. He earned the internship credit at a motor plant instead, selling spare parts for tractors and trucks.

After university he joined Diasoft, which had just opened a large office in Yaroslavl, and spent several years on internal automation: the build pipeline for every product and version, whose failure stopped the business. Their own copy of Jenkins, piles of code over the version control system, a mentor he was lucky to have, and a friend who pointed him at Joel Spolsky and Paul Graham. Alexander notes that the domain is now called platform engineering: nobody outside sees the product, but dogfooding is instant. Evgeny adds that a client can walk up at the office party and tell you what rubbish you wrote. Among his early failures he recalls building a git merge equivalent in SQL — three-storey queries deciding whether one branch folds into another. He did not become a team lead then: he felt he knew too little and dug into the technology for years instead. He worked at Diasoft twice, with a year of consulting in between, returning to the platform team, where he ran the platform on IBM z/OS and wired a fingerprint sensor shipped from the States as a black box into a web application.

What pushed him out was the last big project: migrating complex software from Oracle to PostgreSQL with a code translator on plain grammars and SQL substituted through traffic sniffing — a man in the middle with a JDBC driver convincing the application it still talks to Oracle. A year to eighteen months with no light at the end of the tunnel, and he moved to a Yaroslavl service company doing custom development for Microsoft, Google and other Silicon Valley clients. There a medical startup was waiting whose source tree held not a single .java file: confidential medical data was not entrusted to Russian contractors, and the backend came only after years of work and trips to Seattle. Instead of exemplary code from a former Sun Microsystems team lead he found one servlet with do get and do post and if-else nesting eighty or ninety levels deep, written by an experienced architect from the pre-object-oriented generation who had since retired.

From there the conversation turns to changing generations: Alexander recalls The Structure of Scientific Revolutions, by Thomas Kuhn as he remembers it — an old theory holds until its apologists retire. Evgeny answers with the plus signs used instead of joins in PL/SQL, syntax from the eighties that experienced bank developers pass down as a convenient habit, and recommends the short book Driving Technical Change on resistance to technical change. Then the mechanics of custom development: two funnels, sales and delivery; a rare chance to go deep into one technology; and the best outcome, where the client feels no border between his own team and the contractor. The Yaroslavl office grew from thirty people to more than two hundred, and in 2022 the team was left without work — hence Raft, named with partners not after the consensus algorithm but after a summer day on inflatable rafts.

The first year was turbulent: they hunted for clients at every conference going before realising they needed business events, where talks are paid for and you leave with a pocket full of cards. They bet on generative AI — the team had several machine learning projects behind it, down to experiments with GPT-2, and there was nothing to lose; in 2023 the margin target was lifted from the unit so they could see what actually gets adopted, favouring startups with little money that moved fast. Security had entered his life earlier: on the medical project, as technical director, he spent two months writing around fifty documents in English to meet American requirements for medical data, with no ChatGPT. One of them required testing the software against attacks; the team took the OWASP Top 10 methodology, found exploitable vulnerabilities, and got a dressing down — the client's deadlines were burning and the findings had made him officially notified, so they were told to stop.

Evgeny came to OWASP as a volunteer, to learn how the industry solves the problem his team failed to sell or build in 2023. The top ten vulnerabilities of large language models is the first Google result and therefore the main argument in negotiations, but he calls the 2024 document strange: prompt injection is an attack technique rather than a vulnerability, denial of service has little to do with LLMs, and hallucinations are there because the authors want people to think about them; the list comes from the vote of a small group, not from incident statistics. His own item on function calling did not make the 2025 version but was carried into the work on agentic systems. After the course with the Talent Hub master's programme, Raft opened an attack lab at the university, whose experiments grew into a packaged product: monitoring that clears an agentic system's telemetry noise down to what a SIEM and an analyst can use, plus guardrail models, so a chatbot recommending books does not start advising on medicines. A few weeks ago the MIPT startup studio invested, and the product was spun out of Raft.