Expert perspectives on application security, compliance, and emerging threats
StandardsScope - What This Guide Covers This guide explores how the 2025 OWASP Top 10 update impacts your security engineering practices when using AI coding assistants, deploying AI-powered features, or integ
GeneralThe myths around federal software supply chain security persist because they re comfortable. They let you treat authorization as a one-time event, vulnerabilities as a scoring exercise, and compliance
ResearchYour organization now requires a Software Bill of Materials (SBOM) for every release, and your CI/CD pipeline generates them automatically. However, a recent study of 25,882 Java SBOMs revealed that 7
StandardsThe Challenge A consortium of financial institutions participating in the UK-US PETs Prize Challenges faced a significant issue: how to train a shared fraud detection model across vertically partition
Get weekly security insights and compliance updates delivered to your inbox.
GuidesYour open source project finally earned the OpenSSF Baseline Badge. You added it to your README, announced it on social media, and moved on. Three months later, a critical vulnerability in your depend
StandardsNIST is establishing a dedicated program for AI cybersecurity and privacy. For your compliance team, this raises a critical question: should you adopt the AI Risk Management Framework now, or continue
ResearchThe Challenge The European Union s draft of the Cyber Resilience Act (CRA) initially treated open source software like commercial products, imposing liability on community maintainers—volunteers often
IncidentWhat Happened A threat actor compromised the Cline CLI package on npm and modified it to silently install OpenClaw—an AI coding agent—on developer machines without consent. The malicious version was l
StandardsThe Challenge Your compliance team faces a recurring problem: Python developers move fast, while security teams move carefully, creating a risk gap. When uv emerged as a high-performance Python packag
GuidesWhy This Matters Your application needs to integrate with third-party services like Google Workspace, Salesforce, and GitHub without collecting and storing user passwords. You ve heard just use OAuth,
GeneralYour developers are shipping code faster than ever, thanks to AI coding assistants. However, if you re still using the same security tools from three years ago, you re accumulating risk faster than yo
StandardsWhat Changed GitHub s Secure Open Source Fund (SOSF) has added two Software Bill of Materials (SBOM) generators to its portfolio: cdxgen and CycloneDX .NET. These projects now receive funding, securit
GuidesYour security team finds vulnerabilities. Developers fix them three sprints later. Finance sees security tooling as pure overhead. This cycle burns budget and slows delivery. The solution is not anoth
StandardsYour development team just adopted an AI coding assistant. Within weeks, your commit velocity doubled. Your security team celebrated the reduced vulnerability count in static scans. Then you discovere
GeneralYour developers are shipping faster than ever. Pull requests are flying through review. Sprint velocity is up 30%. Meanwhile, your security team is quietly panicking. These myths persist because AI co
