Expert perspectives on application security, compliance, and emerging threats
GeneralYou download millions of packages from npm, PyPI, or Packagist each year. Your CI/CD pipeline queries these registries thousands of times per day. Your entire deployment process assumes they ll respon
GuidesCISA has released the Open Source Software: Security Principles and Practices guide for federal agencies, but it s a valuable resource for any organization managing open source software (OSS). This gu
StandardsCISA s updated SBOM minimum elements have arrived, incorporating over 90 public comments. You re now faced with four new required fields: Component Hash Algorithm, Component License, SBOM Tool Name, a
IncidentOn Monday, 37 organizations, including Nvidia, Palantir, and Hugging Face, announced the formation of the Open Secure AI Alliance. These companies are committed to developing tools and techniques for
Get weekly security insights and compliance updates delivered to your inbox.
GuidesYour compliance team needs a governance framework for AI agents, but you can t govern what you can t see. 80% of organizations have already encountered agentic AI risks, yet only 21% have mature gover
GeneralYour compliance team just approved AI agents for customer support. Two weeks later, one starts hallucinating PII into responses. You need to shut it down without breaking the other twelve agents handl
GeneralYour compliance team might think AI observability is just another term for monitoring. That s not quite right, and this misconception can lead to audit risks. These myths persist because AI workloads
IncidentWhat Happened In 2025, GitHub s public repositories exposed 28,649,024 new secrets, a 34% increase from the previous year. The root cause wasn t a single breach. It was systemic: AI-assisted developme
ResearchScope This guide covers how to identify and prioritize security-relevant code changes that ship without CVE assignments or security advisories. You ll learn to build a process that catches exploitable
GeneralMost discussions about AI coding tools focus on whether the generated code is secure. That s the wrong question. The real risk isn t what the AI writes at the moment, it s what it pulls in from the ec
GeneralScope This guide tackles the challenge of ensuring your AI agents perform precisely as instructed, without deviation. If your team deploys AI systems that act on behalf of users, like booking resource
GeneralYou ve probably heard the pitch: AI coding assistants will make your developers more productive, catch bugs earlier, and ship features faster. All true. What the vendor demos won t show you is what ha
GeneralCompliance teams at regulated organizations often hear that AI will revolutionize development speed. What they re thinking: Great, another technology that ll create audit findings. This skepticism isn
IncidentThe Challenge In late 2024, Anthropic s AI system Mythos showcased its ability to analyze codebases and identify vulnerabilities in minutes. This wasn t a breach, but it highlighted a critical issue:
IncidentOn a Thursday afternoon, CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog, giving federal agencies until Friday to patch. This vulnerability in Langflow, a low-code framework fo
IncidentWhat Happened Between January 14 and February 12, 2025, WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 had a remote code execution vulnerability in the core REST API batch endpoint ( b
