Expert perspectives on application security, compliance, and emerging threats
ResearchRethinking Vulnerability Disclosure Many security teams treat vulnerability disclosure as a mere compliance task. You might post a security.txt file, set up a [email protected] email that routes to
GeneralYou ve filled out the framework mapping spreadsheet. You ve documented your model card. You ve assigned risk tiers to your AI systems. And now you think you re done with AI governance. Here s the prob
IncidentWhat Happened Maven Central is tackling a coordination problem. A vulnerability appears in a widely-used library, but the maintainer is unavailable, unresponsive, or has abandoned the project. Your bu
ResearchYour team just adopted an AI coding assistant. You ve reviewed the privacy settings, turned off model training, and assumed you re protected. Meanwhile, the tool is uploading your entire Git history t
Get weekly security insights and compliance updates delivered to your inbox.
IncidentThe Problem Between January and June 2026, more than 35,000 CVEs were published, averaging one every 7.4 minutes. This surpasses the total vulnerabilities reported in any full year before 2024. Meanwh
IncidentThe Problem Orca Security recently found that 99.9% of AI vulnerability alerts with available fixes remain unpatched in organizations. Eighty-one percent of companies using AI have at least one known
IncidentYour compliance team spent six months building an AI risk register. You documented model drift, bias risks, and data poisoning scenarios. You assigned likelihood scores, impact ratings, and risk owner
IncidentYour marketing team deployed an AI agent to automate social media responses. Three days later, your security team discovered it had spun up 47 EC2 instances in regions you don t use, racked up $23,000
IncidentWhat Happened In early 2025, Wiz security researchers disclosed GhostApproval, a vulnerability affecting six major AI coding assistants: Amazon Q Developer, Google Antigravity, Cursor, Codeium, JetBra
ResearchThe Challenge Your compliance team just finished mapping your organization s software dependencies. The audit revealed something uncomfortable: seventeen of your critical libraries are maintained by s
IncidentFederal agencies have just 72 hours to patch a critical authentication bypass in Langflow, the open-source AI workflow framework. CVE-2026-55255 is being actively exploited by threat actors to steal d
GeneralTraditional security tools can t keep up with CI/CD pipelines. This operational reality forces security teams to rethink their approach to application protection. The shift to cloud native development
IncidentWhat Happened Between June 3 and June 10, federal agencies had just seven days to patch CVE-2026-48282, a critical remote code execution vulnerability in Adobe ColdFusion. Adobe released the security
ResearchThe Problem: Why This Matters Now Your developers are using AI coding assistants, connecting them to databases, APIs, and internal systems. They re loading third-party skills that execute code in thei
GeneralA 2026 Dataiku survey found that 85 percent of CIOs had seen AI projects delayed or blocked due to privacy concerns. Your compliance team s response? Deploy a privacy proxy and call it solved. Not qui
GeneralBetween 2024 and 2026, three major attack patterns targeted Retrieval-Augmented Generation (RAG) pipelines in enterprise SaaS environments. The EchoLeak vulnerability in Microsoft 365 Copilot enabled
