Expert perspectives on application security, compliance, and emerging threats
StandardsIf you re deploying AI agents that make decisions, execute code, or access production systems, you need governance controls before they go live. Microsoft s recent release of the Agent Governance Tool
StandardsThese questions arise when someone discovers the OWASP API Security Top 10 2023 (released June 5, 2023), and their team is already deploying new endpoints. They re trying to understand what Broken Obj
StandardsScope - What This Guide Covers This guide focuses on implementing machine identity security programs. You ll find specific controls for service accounts, API keys, certificates, tokens, and AI agents
StandardsMozilla scanned Firefox using Opus 4.6, then gave Claude Mythos access to the codebase. The AI model identified 271 vulnerabilities in Firefox 150. This was not a research project or a proof of concep
Get weekly security insights and compliance updates delivered to your inbox.
StandardsWhen you discover unauthorized access to your GitHub organization, the first 60 minutes determine whether you contain the breach or watch it spread to every downstream dependency. This runbook provide
StandardsThe compromise of the Axios npm package through social engineering highlights a critical vulnerability in the software supply chain: the security of your dependencies is only as strong as the people w
StandardsOn April 22, 2026, malicious versions of xinference appeared on PyPI, targeting AI inference servers with credential theft payloads that leave no persistent traces. This attack marks a tactical shift:
StandardsOn April 23, 2026, Mend.io discovered a compromised package on npm masquerading as @bitwarden/cli version 2026.4.0. This package combined three attack mechanisms: a self-propagating npm worm, a GitHub
StandardsSocket and StepSecurity detected a supply chain worm in npm packages that doesn t just steal credentials—it spreads itself. The attack, tracked as CanisterSprawl, uses postinstall hooks to exfiltrate
StandardsYour team likely relies on the NVD scores to decide what to patch, with automation pulling CVSS data to prioritize remediation. Now, NIST is shifting its focus, having enriched nearly 42,000 CVEs in 2
StandardsThe Challenge Between 2020 and 2023, CVE submissions grew 263%. Last year alone, NIST enriched almost 42,000 CVEs—a 45% year-over-year increase. Then NIST announced it would no longer analyze every vu
StandardsYour vulnerability management program is about to undergo a significant transformation. AI models that autonomously discover vulnerabilities at scale are now production tools. Your team needs a deploy
StandardsScope This guide focuses on detecting and mitigating supply chain attacks that use audio steganography to hide malicious payloads in software packages. Our case study is the March 27, 2026 compromise
StandardsA compromised maintainer account on npm deployed a cross-platform Remote Access Trojan (RAT) through malicious versions of Axios, a widely used JavaScript HTTP client library. If your systems ran npm
StandardsA recent campaign distributing over 300 poisoned packages shows how attackers now use AI to scale supply chain attacks. Your dependency scanning probably caught the known signatures, but it won t catc
StandardsThese questions started showing up in security Slack channels right after StepSecurity flagged two hijacked npm packages in the React Native ecosystem. These packages, with over 30,000 downloads per w
