Osama Al-Wardi.

Osama Al-Wardi

Cyber Security Engineer at PROGNOST Systems GmbH

My research interests include agentic AI security, penetration testing, systems and software security, and static and dynamic program analysis.

Explore my research Download CV
Osama Al-Wardi

Featured publication / ICGT 2024

Static and dynamic taint analysis to investigate broken access control and data leakage in GraphQL APIs.

View publication

01 / Selected work

Research & publications

Research projects

01Software security / 2022–2023

GraphQL taint analysis

Combining static and dynamic taint analysis to investigate broken access control and data leakage in GraphQL APIs.

Read about the research

My master’s research at BTU Cottbus-Senftenberg modeled GraphQL schemas and operations using typed graphs and graph-transformation rules. Dependency analysis identified security-relevant source/sink operation pairs.

I designed an evaluation using GitHub’s GraphQL API, implemented Python-based dynamic tests across users with different privileges, and compared the approach with Schemathesis. This work developed into the ICGT 2024 paper.

02AI agents & security / 2023

KanAxe: AI agents for cyber security

A research-transfer project exploring LLM-based agents for penetration testing, cloud security, and compliance workflows.

Read about the project

I helped develop early LangChain-based agents that used security tools, interpreted their output, and selected subsequent actions.

The work explored context limitations, retrieval, reliability on specialized security tasks, and orchestration with human supervision. The project developed into an application for EXIST Research Transfer.

Research interests

  • Agentic AI security
  • Systems & software security
  • Access control
  • Information flow
  • Static & dynamic program analysis
  • Isolation
  • Runtime policy enforcement

Publications

02 / In practice

Professional experience

From research to real systems
2024 — PresentCurrent role

Cyber Security Engineer

PROGNOST Systems GmbH

Cyber security engineering for operational technology and industrial control systems in industrial environments.

  • Contribute to product certification projects involving IEC 62443-3-3, UR E27, and the EU Cyber Resilience Act.
  • Penetration testing, vulnerability scanning and management, authentication and authorization testing, cloud asset monitoring, and code reviews.
2022 — 2023

IT Security Consultant

Insentis GmbH

Penetration tests and security assessments across web applications, APIs, mobile applications, enterprise environments, and Active Directory.

Validated vulnerabilities, analyzed attack paths, and communicated findings and remediation guidance through technical reports.

2020 — 2022

Penetration Tester

Philotech GmbH / Working student

Conducted penetration tests, code audits, and red teaming for automotive products, including projects with Audi and BMW. Tested infotainment systems and embedded attack surfaces.

Contributed to autonomous-driving risk assessments and designs related to automotive security operations centers.

2019

Software Engineering Intern

FARO Europe / Stuttgart, Germany

Developed software for 3D measurement, imaging, and realization using Python and the Robot Operating System (ROS) for heuristic and classification tasks.

Worked with specialized hardware and tested software for security vulnerabilities.

2019

Research Assistant

Universität Bremen / Digital Media Labs

Supported PhD researchers investigating the security of the Bluetooth Low Energy protocol.

Developed an Nmap-inspired scanning tool to discover Bluetooth devices.

2018

Web Development Intern

Universität Bremen

Implemented a web application to classify smart-home systems by their security properties.

The application generated recommendations and best-practice guidance for designing, implementing, and testing smart-home systems.

Professional certifications

Certified Azure Red Team Professional (CARTP) · Altered Security

Certified in Cybersecurity (CC) · ISC2

03 / Academic foundation

Education

2020 — 2023 / Cottbus, Germany

M.Sc. Cyber Security

Brandenburg University of Technology
Cottbus-Senftenberg

Master’s thesis

Design and Implementation of Taint Analysis for GraphQL-based Web Applications

Download master’s thesis (PDF)

Final grade: 1.9 · Research-oriented program · 124 credits

2017 — 2020 / Bremen, Germany

B.Sc. Computer Science

Constructor University
Formerly Jacobs University Bremen

Bachelor’s thesis

Performing Service Dependency Discovery on Web Application Clients

Download bachelor’s thesis (PDF)

Final grade: 2.77

Sharing knowledge

Teaching &
academic experience

As a Scientific Assistant (HiWi) during my studies, starting in 2019, I supported professors with teaching and lab management, and students with tutorials, practical exercises, and technical guidance.

Advanced Programming in Python

Teaching Assistant · Jacobs University Bremen

Led tutorials and help sessions, supported labs, and graded assignments and exams.

Computer Networks

Teaching Assistant · Jacobs University Bremen

Explained networking concepts, supported tutorials, and graded coursework.

Ethical Hacking Laboratory

Teaching Assistant

Supported hands-on security exercises and learning in practical offensive security.

Simulation library development

Project Assistant

Contributed to porting a simulation library from JavaScript to Python.

About

I’m a security engineer based in Bremen, Germany, with a research background in program analysis and access control and experience securing industrial, automotive, cloud, and application systems.

I’m interested in PhD research in software and systems security, particularly how program analysis and runtime enforcement can constrain the permissions and actions of AI agents.

[email protected]

The full picture

Curriculum vitae

Research, publications, professional experience, and technical skills.

Download CV PDF