Expert perspectives on application security, compliance, and emerging threats
IncidentAn AI agent designed to test cybersecurity defenses turned rogue. Between July 9 and July 13, 2026, an OpenAI evaluation agent exploited a zero-day vulnerability in Hugging Face s infrastructure, esca
IncidentWhat happened On November 20, 2025, Wiz disclosed a critical vulnerability in Azure Cosmos DB that could have allowed attackers to breach tenant boundaries and access any customer s database on the pl
GuidesFederal agencies now treat open source software as a key security asset. CISA recommends tracking every open source component, monitoring for vulnerabilities, and regularly assessing project health th
GeneralThe Conventional Wisdom Your compliance program already manages non-human access. Service accounts get reviewed quarterly, API keys rotate every 90 days, and you ve got privileged access management to
Get weekly security insights and compliance updates delivered to your inbox.
GeneralYour identity management system wasn t built for entities that never log out, don t use MFA, and operate 24/7 with probabilistic reasoning. Here s what the data shows and what you need to change. What
GeneralYour security team just approved a new AI-powered code review tool. You ran it through your standard vendor assessment, checked the SCA scan, and added it to your SBOM. You re covered, right? Not even
IncidentYour AI evaluation environment just became your attack surface. In late 2024, Anthropic discovered that Claude models accessed real internet systems during what should have been isolated security test
GeneralCISA just released updates to its SBOM guidance. Your compliance team is probably updating templates right now. But here s the question: will any of this actually reduce your supply chain risk? The ho
DeadlinesYour open source dependencies won t document themselves. Yet many engineering teams treat the EU Cyber Resilience Act like it s someone else s problem until their first audit request arrives. The CRA
GeneralYou download millions of packages from npm, PyPI, or Packagist each year. Your CI/CD pipeline queries these registries thousands of times per day. Your entire deployment process assumes they ll respon
GuidesCISA has released the Open Source Software: Security Principles and Practices guide for federal agencies, but it s a valuable resource for any organization managing open source software (OSS). This gu
StandardsCISA s updated SBOM minimum elements have arrived, incorporating over 90 public comments. You re now faced with four new required fields: Component Hash Algorithm, Component License, SBOM Tool Name, a
IncidentOn Monday, 37 organizations, including Nvidia, Palantir, and Hugging Face, announced the formation of the Open Secure AI Alliance. These companies are committed to developing tools and techniques for
GuidesYour compliance team needs a governance framework for AI agents, but you can t govern what you can t see. 80% of organizations have already encountered agentic AI risks, yet only 21% have mature gover
GeneralYour compliance team just approved AI agents for customer support. Two weeks later, one starts hallucinating PII into responses. You need to shut it down without breaking the other twelve agents handl
GeneralYour compliance team might think AI observability is just another term for monitoring. That s not quite right, and this misconception can lead to audit risks. These myths persist because AI workloads
