Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
The Evolution of the OWASP LLM Top 10: From 2023 to 2025 and 2026, the Agentic Top 10 and the Agent Control Standard
In the OWASP LLM Top 10 the same ID can point to three different risks in three editions: 2023's LLM06 was sensitive information disclosure, 2026's is Unbounded Consumption. We align the 2023, 2025 and 2026 lists by topic, cover dissolved and added entries, the 2026 rank moves, the Agentic Top 10 and the Agent Control Standard, and write a C# tool that moves an old penetration test report to 2026 IDs.
Risk Management in Software Projects: Pre-Mortem, Risk Register, Probability × Impact and Retiring Risk Early
Managing risk means surfacing it early with a pre-mortem, comparing probability × impact with the buffer and putting the riskiest work at the start of the plan. In Bookstore's Institutional Orders register, total exposure is 21.6 days, more than the scope buffer; an ERP spike and pair work bring it down to 4.9 days in three sprints. We cover ROAM, risk burndown and risk vs issue with C# code.