Expert perspectives on application security, compliance, and emerging threats
StandardsYou re facing a decision: your organization is deploying LLMs, and you need to secure them. The OWASP LLM AI Cybersecurity Governance Checklist offers a structured six-step approach to LLM strategy. B
StandardsThe Second NIST Cyber AI Profile Workshop highlighted a key issue in AI governance: the disconnect between enterprise-level policy and the engineers tasked with implementation. The Challenge NIST s Pr
StandardsCISA s updated SBOM minimum elements have arrived, incorporating over 90 public comments. You re now faced with four new required fields: Component Hash Algorithm, Component License, SBOM Tool Name, a
StandardsThese questions come from compliance teams I ve talked to over the past six months. The new PCI DSS v4.0.1 requirements around payment-page scripts caught many organizations off guard. Requirement 6.4
Get weekly security insights and compliance updates delivered to your inbox.
StandardsThe National Vulnerability Database backlog isn t just NIST s problem—it s yours. When the OIG found that analysts severity calculations matched NIST s only 12% of the time, they exposed a systemic is
StandardsStarting April 15, NIST will stop enriching and scoring lower-priority vulnerabilities. Submission volumes grew 263% while NIST enriched 42,000 CVEs in 2025 — they can t keep up. If your vulnerability
StandardsYour PHP applications rely on Composer . If you re running versions between 2.0 and 2.2.27 or between 2.3 and 2.9.6, you are exposed to command injection vulnerabilities in your dependency management
StandardsScope - What This Guide Covers With NIST reducing its role in CVE data enrichment, your vulnerability management program must adapt. This guide details the changes, their impact, and the necessary adj
StandardsNIST enriched nearly 42,000 CVEs in 2025, a 45% increase over previous years. Yet they just announced they re scaling back. Why? CVE submissions jumped 263% between 2020 and 2025, and the old model of
StandardsI ve been fielding urgent questions about CVE-2026-40478 in Thymeleaf. Many teams using Java Spring apps with Thymeleaf are now facing a 9.1 CVSS vulnerability that allows unauthenticated attackers to
StandardsWhen Socket alerted on malicious Docker images in the official checkmarx/kics repository—including a new tag v2.1.21—and compromised VS Code extensions (checkmarx/ [email protected] and 1.19.0), se
StandardsYour team just deployed an AI agent to automate incident response. It needs to query your SIEM, update tickets, and potentially disable compromised accounts. The question you re facing: how do you gra
StandardsYour open-source project just received an email from someone claiming to be a core maintainer, asking for elevated repository access. The writing style matches, and the email domain looks legitimate,
StandardsScope - What This Guide Covers This guide defines security responsibilities for teams deploying AI systems from third-party vendors. It addresses: Which security controls belong to your team vs. the v
StandardsYou ve seen the reports. NIST has changed the way it prioritizes software flaws in its CVE framework. The shift is clear: focus on high-impact vulnerabilities, not just volume. This isn t about abando
StandardsOver the past month, I ve encountered the same set of questions in multiple forums, all centering on Anthropic s Claude Mythos—an AI model that claims to find and weaponize vulnerabilities at an unpre
