Software Engineering Institute

New AI Flaw Reporting System Fills Crucial Security Gap

Flaw Reporting for AI (FLARE-AI) allows developers and security researchers to submit artificial intelligence flaws for formal, coordinated disclosure.
sei.cmu

The SEI CERT Coding Standard for Fortran

Svoboda, D., 2026: The SEI CERT Coding Standard for Fortran. Software Engineering Institute blog, Accessed July 1, 2026, https://doi.org/10.58012/w9t7-6y96. This blog ...
sei.cmu

SEI and Accenture Release AI Adoption Maturity Model to Help Organizations Scale AI with Predictable Outcomes

PITTSBURGH, Pa., June 8, 2026—The Carnegie Mellon University Software Engineering Institute (SEI) and Accenture today released the Artificial Intelligence (AI) Adoption Maturity Model, an empirically ...
sei.cmu

The ELM Library: An LLM Evaluation Toolset

Turri, V., Schieber, N., Loughin, C., and Brooks, T., 2026: The ELM Library: An LLM Evaluation Toolset. Software Engineering Institute blog, Accessed July 9, 2026 ...
sei.cmu

SOK: Bridging Research and Practice in LLM Agent Security

Large Language Model agents are rapidly transitioning from research prototypes to deployed systems, raising new and urgent security challenges. Unlike static chatbots, LLM agents interact with ...
sei.cmu

7 Recommendations to Improve SBOM Quality

Tobar, D., Jamieson, J., Priest, M., and Fricke, J., 2025: 7 Recommendations to Improve SBOM Quality. Software Engineering Institute blog, Accessed July 7, 2026 ...
sei.cmu

Security Engineering Framework (SEF): Managing Security and Resilience Risks Across the Systems Lifecycle

Software is a growing component of modern business- and mission-critical systems. As a result, software assurance is becoming increasingly important to organizations across all sectors. A key aspect ...
sei.cmu

Generative AI and Software Engineering Education

Ozkaya, I., and Schmidt, D., 2024: Generative AI and Software Engineering Education. Carnegie Mellon University, Software Engineering Institute's Insights (blog ...
sei.cmu

Application Programming Interface (API) Vulnerabilities and Risks

This report describes 11 common vulnerabilities and 3 risks related to application programming interfaces, providing suggestions about how to fix or reduce their impact. Application programming ...
sei.cmu

Creating a Large Language Model Application Using Gradio

Brooks, T., 2023: Creating a Large Language Model Application Using Gradio. Software Engineering Institute blog, Accessed July 3, 2026, https://doi.org/10.58012/7mv7 ...
sei.cmu

The 13 Key Elements of an Insider Threat Program

Costa, D., and Trzeciak, R., 2023: The 13 Key Elements of an Insider Threat Program. Software Engineering Institute blog, Accessed July 1, 2026, https://doi.org/10. ...
sei.cmu

Insider Threat Program Evaluation

The Insider Threat Program Evaluation (ITPE) is an evidence-based, capability-level assessment. The ITPE is designed to benchmark an organization's insider threat program against a reference model ...