The 28-to-0 Controls Debate: Are Your Pipelines Secure? Alex Kantor, Kosli - OS in Finance Podcast

On this episode of the FINOS Open Source in Finance Podcast, host Grizz Griswold sits down with Alex Kantor, Director of Technology at Kosli and maintainer for the FINOS Open SDLC Controls Framework. Alex shares his career journey from bypassing slow manual controls to turning automated governance into a competitive advantage—scaling deployments from 2 to 23 per day. He unpacks his famous "race car brakes" metaphor, tackles the explosion of automated AI vulnerability scanners, details the impact of the EU Cyber Resilience Act on SBOM tracking, and explores who is verifying AI-generated code in pull request reviews.

🕒 Timestamps:0:00 Welcome to the FINOS Open Source in Finance Podcast1:12 OSFF NY Announcement & Hands-On SDLC Workshop Preview2:10 Alex Kantor’s Role at Kosli: Governance Engineering Platform4:32 Career Roots: From Unix Infrastructure to Tesco Bank6:29 Poacher Turned Gamekeeper: Shifting from Control Dodger to Owner8:43 Automating Segregation of Duties: Scaling from 2 to 23 Deployments/Day11:25 The Race Car Brakes Metaphor: Why Controls Drive Speed13:29 FINOS SDLC Controls Framework: Speaking a Common Language with Auditors17:52 AI in the SDLC: Who’s Checking the AI Reviewers?19:18 Rising Vulnerabilities, Mythos Scanners & EU CRA SBOM Mandates24:40 OSFF New York Talk Preview & Hands-On Workshop Details27:08 The 28-to-0 Controls Debate: New Vectors, Same Core Risks30:08 Homework for Engineers: Turning Silent Human Trust into Automated Checks 📊 The Problem: Friction-Heavy Governance & Rapid AI Vulnerability ExploitationControls as Bureaucratic Roadblocks: Enterprise financial institutions frequently treat software delivery controls as friction—relying on manual spreadsheets, screenshot gathering, and rigid team-to-team handoffs that stall innovation and delay time-to-market. Accelerated Exploit Windows: Automated AI scanning engines (such as Mythos) are identifying and exploiting software vulnerabilities at unprecedented rates, shrinking remediation windows to negative days and flooding bug bounty channels with alerts. Fragmented Audit Definitions: Inconsistent nomenclature across internal audit teams, engineering orgs, and external regulators creates policy paralysis and compliance confusion under upcoming frameworks like the EU Cyber Resilience Act (CRA). 🏗️ The Solution: Governance Engineering & The FINOS Open SDLC FrameworkAlex Kantor outlines how Kosli and FINOS help engineering teams automate controls to move faster: The "Race Car Brakes" Philosophy: Treating automated controls not as speed limiters, but as high-performance brakes that give developers the confidence to push release velocity to the limit. Automated Evidence & Segregation of Duties: Capturing continuous, immutable provenance across CI/CD pipelines to prove person-to-person segregation of duties and track live Software Bills of Materials (SBOMs) without manual audit overhead. FINOS SDLC Common Controls Catalog: Establishing an open, standardized taxonomy of software development controls so banks, auditors, and regulators share an unambiguous operational language. ⚙️ Why This Matters for Financial EngineeringDramatic Delivery Acceleration: Automating audit evidence collection eliminates release bottlenecks, enabling regulated firms to jump from batched deployments to continuous daily delivery. Governing Agentic Coding: Replaces silent, unverified trust in human reviewers with explicit, automated pipeline assertions to govern both human and AI-generated code changes. 🌐 More about FINOS: https://www.finos.org/ 📧 Join our newsletter: https://www.finos.org/sign-up 🎙️ Listen to our Open Source in Finance Podcast: https://www.youtube.com/@FINOS/podcasts LinkedIn: https://www.linkedin.com/company/finosfoundation#FINOS #OSFFNewYork #Kosli