Home / Articles / GenAI in Portuguese, 2024: my OWASP Global AppSec talk in Lisbon, the first public demo of The Cyber Boardroom, slide by slide, with what two years of agents have confirmed and changed

GenAI in Portuguese, 2024: my OWASP Global AppSec talk in Lisbon, the first public demo of The Cyber Boardroom, slide by slide, with what two years of agents have confirmed and changed

By Dinis Cruz · 2026-10-16 · article v1.0.0 · newsroom v0.12.78 · portugalowaspgenaicyber-boardroomtalksprovenancegraphsagentslanguagehistoryarticle

Abstract: On 28 June 2024, at OWASP Global AppSec EU in Lisbon, I gave Deterministic GenAI Outputs with Provenance, 132 slides and a live demo of The Cyber Boardroom, the project I had been building for two months: an assistant that explains cyber security to board members, in their language and at their level. The talk opened with a quiz, what is the sixth most powerful programming language in the world, and the answer was Portuguese, because prompts are written in natural languages and 236 million people speak it first. Its core was a set of principles: GenAI matters because it can understand content, not because it creates it; hallucinations are a feature for creativity and a bug for facts; use read-only models, bring your own content, assume every prompt is exposed, and use graphs instead of RAG. And it ended with a challenge to Portugal: the future depends on getting this right, otherwise Portugal becomes just another consumer of global technology. Two years later most of it holds, and some of it is the foundation of what I do now: provenance, graphs and determinism are the core of this newsroom; the board assistant became agents with a mandate; and Portugal has released Amália, an open model for European Portuguese, which is what I asked for. What changed is the word: in 2024 I talked about models and prompts; in 2026 it is agents, and the problem is controlling what they do.

In short

• June 2024, Lisbon. OWASP Global AppSec EU; 132 slides; a live demo.
• Portuguese is a programming language. The sixth most powerful, by speakers.
• GenAI understands. That matters more than that it creates.
• Principles. Read-only models, your own content, prompts exposed, graphs not RAG.
• The Cyber Boardroom. Explaining security to a board, in its own language.
• A challenge to Portugal. Lead, or be another consumer of technology.
• Two years later. Provenance and graphs hold; models became agents.

The talk

On Friday 28 June 2024, in the last session before the closing of OWASP Global AppSec EU at the Lisbon Congress Centre, I gave Deterministic GenAI Outputs with Provenance. The page on my site has the slides, the video and a full transcript. I said at the start: "my focus (and this presentation) is on GenAI". The title was the whole argument: deterministic, GenAI, output, with provenance, "Traceability, Source Tracking & Documentation, Lineage, Origin Verification".

Portuguese is a programming language

It began with a quiz for the room: what is the sixth most powerful programming language in the world? "Since data is now code, and GenAI prompts are written in natural languages", the answer was Portuguese: "Portuguese, as English and every other language in the world (dead or alive) can be used to give instructions to LLMs", to "define actions, workflows and create applications". With 236 million first-language speakers, that is a lot of programmers. And I asked for models in our language: "we need Portuguese from Portugal, Portuguese from Angola, Portuguese from Mozambique, Portuguese from Cape Verde".

Two years later. It happened, at least for Portugal: Amália, an open model for European Portuguese, built on the European EuroLLM and released as open source in 2026, with a technical report and a benchmark for pt-PT. The other varieties are still waiting. And the idea that language is the programming language is now ordinary: it is what explorer coding is.

Understanding, not creating

The slides I would keep in any version: GenAI is the next technological revolution "Not because it can CREATE content, But because it can UNDERSTAND content"; hallucinations "Are a FEATURE when creating content and when we want creativity, But are a BUG and PROBLEM when we want facts, evident and trust". Is it secure? No. Is it safe? Maybe, depending on implementation. From an attacker's point of view, GenAI is "Your most vulnerable API", "Your most dangerous Insider Threat" and "A crazy 'Black Box'".

Then the principles: "Read-only models", "It's about the Prompts", "Bring your content", "Assume all content and prompts are exposed", "Double down on AppSec and Cyber". And one slide I am proud of now: Use Graphs instead of RAG. In the talk I said: "I think the stuff with graphs is a lot more interesting. I think you take the content, you summarize, you build graphs of it, then you navigate the graph."

Two years later. This is the part that held best, because it became the work. Provenance is the rule of this newsroom: every claim checked against a source and linked. Graphs became fractal semantic graphs, and every article here has one. Determinism became the principle that the further a thing moves towards commodity, the fewer agents in line. What changed is the threat: in 2024 the insider was a model answering questions; in 2026 it is an agent with tools, and the answer is a behaviour policy and authority outside the model.

The Cyber Boardroom

The middle of the talk was a live demo of The Cyber Boardroom, which I had spent the previous two months building, open source, with every release on PyPI, Docker Hub and AWS. The problem it solved was not specific to security: "how do you communicate with stakeholders using their language, culture, knowledge, state, interests, and level of ownership?" I showed it answering a board member's question in several languages, three board-member personas asking the same question, a fourth model reviewing the other three, and Athena, the cyber security advisor, with the prompt that created her on the screen. And: "Security incidents are a good thing", if you use small ones as training.

Two years later. The idea, personalised briefings for people who own the risk, is still at the centre of what I do. The shape changed: one assistant answering questions became teams of agents doing work, each with a role, a mandate and a record, which is what the agentics talk showed last week.

The challenge to Portugal

The talk ended where my Portugal talks always end. To the Portuguese in the room: "the future of Portugal kind of depends on you. I think it can really make a massive difference, but we need to get it right. Otherwise, Portugal just becomes another consumer of global technology, which is not where it should be, because now we actually have the ability to make a difference."

What holds. All of it. It is the same challenge as 2010 and 2016, with a better lever: in 2010 the lever was security, in 2016 code, and in 2024 language. Amália suggests Portugal heard some of it. The essays I wrote the next year took it to the scale of Europe.

What this does not claim

• Not the first time I mentioned The Cyber Boardroom. It was its first live demo in Portugal that I can document.
• Not that the talk led to Amália. Many people asked for a Portuguese model.
• The commentary is mine, now. The slides and transcript are from 2024.

If you were in the room in Lisbon, or want to talk about agents for boards, write to agent@riskmandate.ai.

Where this comes from

A voice memo of mine on 16 October 2026, written by this site's agent in the voice of this site; the commentary and the editorial responsibility are mine. The talk's page on diniscruz.ai, with the slides, the video and the transcript, from which every quote is taken. For today: Amália, via The Next Web and its technical report. Read on 16 October 2026.

Want the next issue by email. One issue a week or so: what was published, what it adds up to, and what is worth your time. Subscribe to the SGit Newsroom →

← All articles