About Me

Mattias Festin crouching behind his dog on a snowy beach.

I'm Mattias Festin, a senior developer, architect, and AppSec specialist at Decerno, working from Kalix in the very north of Sweden. I spend my days at the intersection of application security, AI, and modern systems development, helping teams build software that is secure, sustainable, and still standing when the threat landscape shifts under it.

The through-line in my work: security is a property of quality, not a feature you bolt on at the end. Research puts the cost of fixing a vulnerability found late at up to 640 times that of one caught at design time. I'd rather help you check the foundation than repaint the cracks.

What I do

Application security: technical reviews of code, architecture, and build pipelines, threat modeling, OWASP SAMM maturity work, SBOMs and supply-chain tracking, penetration testing and automated scanning.
AI: practical use of LLMs, embeddings, and retrieval in real systems, including what breaks when you upgrade the models. (I write about that in my embedding drift series.)
Systems development and architecture: building and modernizing custom systems, from legacy rescue missions to greenfield design.

Talks and webinars

Sketch & Build, speaker two years running. Latest talk: "Use the AppSec: när hoten förändras snabbare än koden", a practical look for developers at how modern attacks work, how organized and automated the attacker side has become, and how to protect what you build when AI keeps raising the tempo.
Webinars: I have presented several recorded webinars on security for Decerno, including "Säkerhetsgranskning", on security reviews in practice, from analysis to action, "Vem är hackern?", on who is behind modern cyberattacks and how to defend against them, and "När AI möter applikationssäkerhet", on how generative AI changes the way we build systems and opens new doors for attackers.

Writing

Besides this blog, I write about security for Decerno:

Teknisk granskning: undvik dyra misstag och stärk er säkerhet, on why security reviews pay for themselves, whether you do them early or late.
Säkerhet är kvalité, on SAMM, SBOMs, technical reviews, and static analysis as everyday quality work.

Find me

This site

Generated with Zola
Styled with 98.css by Jordan Scales (MIT license)
Math rendered with Temml (MIT license)
Python.exe powered by Pyodide (MPL-2.0, loaded from jsDelivr)
Winamp.exe powered by Webamp by Jordan Eldredge (MIT license). It really whips the llama's ass.
The playlist is fan-made video game arrangements from OverClocked ReMix, used with artist and site credit per OCR's content policy. Go support the community; the music is free and wonderful.
Icons and other pixel art are from Windows 98 and are © Microsoft Corporation (sourced via the Win98-Icons collection). They appear here as a nostalgic homage; this site is not affiliated with or endorsed by Microsoft.
Retro browsing is served straight from the Internet Archive's Wayback Machine, and please consider donating to them.
Hosted somewhere on the information superhighway

Best viewed in 800×600 at 256 colors.