Expert perspectives on application security, compliance, and emerging threats
StandardsThe Challenge With the introduction of the EU Cyber Resilience Act , your compliance team faces a significant challenge: tracking and proving lifecycle management for every component in your software
IncidentAI s Impact on Vulnerability Discovery In a 90-day period, an AI agent named XBOW submitted over 1,060 valid vulnerabilities to bug bounty programs, surpassing the combined efforts of thousands of hum
GeneralOn February 2nd, maintainers from npm, PyPI, crates.io, and Maven Central met for the first time to address security failures. The OpenSSF Package Manager Security Forum wasn t a celebration—it was a
StandardsThe regulatory environment for software development has fundamentally changed in 2025. What was once guidance is now enforcement, and organizations treating compliance as a checkbox exercise face sign
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened In October 2024, security researchers at Zenity discovered a zero-click vulnerability in Perplexity s Comet AI browser. The flaw, named PerplexedComet, allowed attackers to inject malici
StandardsThe Problem: Data Leakage in Federated Learning Your federated learning models might be leaking training data. Research by Carlini et al. shows that sensitive information, like social security numbers
IncidentWhat Happened Truffle Security discovered nearly 3,000 Google Cloud API keys embedded in publicly accessible client-side code. These keys provided unauthorized access to Google s Gemini API endpoints,
StandardsScope - What This Guide Covers This guide explains how to prepare your security program for NIST s forthcoming AI-specific control overlays, building on NIST SP 800-53 Rev 5 and the NIST Cybersecurity
GuidesThe EU Cyber Resilience Act (CRA) is now a concrete reality. Your organization needs clear processes to translate these regulatory obligations into actionable engineering tasks. This template provides
StandardsScope - What This Guide Covers This guide explores how the 2025 OWASP Top 10 update impacts your security engineering practices when using AI coding assistants, deploying AI-powered features, or integ
GeneralThe myths around federal software supply chain security persist because they re comfortable. They let you treat authorization as a one-time event, vulnerabilities as a scoring exercise, and compliance
ResearchYour organization now requires a Software Bill of Materials (SBOM) for every release, and your CI/CD pipeline generates them automatically. However, a recent study of 25,882 Java SBOMs revealed that 7
StandardsThe Challenge A consortium of financial institutions participating in the UK-US PETs Prize Challenges faced a significant issue: how to train a shared fraud detection model across vertically partition
GuidesYour open source project finally earned the OpenSSF Baseline Badge. You added it to your README, announced it on social media, and moved on. Three months later, a critical vulnerability in your depend
StandardsNIST is establishing a dedicated program for AI cybersecurity and privacy. For your compliance team, this raises a critical question: should you adopt the AI Risk Management Framework now, or continue
ResearchThe Challenge The European Union s draft of the Cyber Resilience Act (CRA) initially treated open source software like commercial products, imposing liability on community maintainers—volunteers often
