Expert perspectives on application security, compliance, and emerging threats
GeneralYour marketing team recently used an AI agent to build a customer analytics dashboard. The agent selected three npm packages that seemed perfect: tracking user behavior, exporting data to CSV, and sen
GeneralSecurity vendors and AI labs are promoting large language models as the future of automated vulnerability detection. The excitement peaked when XBOW evaluated Anthropic s Mythos Preview model, noting
GeneralSecurity teams often treat browser security as a simple task—install an extension, block a few domains, and consider it done. However, your true attack surface lies in the thousands of active browser
GeneralScope This guide addresses credential theft and malware propagation through package registries, focusing on the NPM ecosystem. You ll find steps for detecting supply chain compromise, hardening develo
Get weekly security insights and compliance updates delivered to your inbox.
GeneralScope - What This Guide Covers This guide focuses on access control and containment strategies for AI agents with elevated permissions in your environment. You ll find specific steps for limiting agen
GeneralYour team likely runs static analysis on code after it s committed, scans containers before deployment, and uses software composition analysis to track known CVEs in your dependencies. However, if you
GeneralUnderstanding the Risk The npm package strip-ansi-cjs appears in your dependency tree with 529 dependents and 7,274 weekly downloads, yet it s completely empty. This is not just a theoretical risk—it
GeneralThe Conventional Wisdom Security teams are delaying agentic AI deployments until purpose-built security tools mature. This seems prudent: the tools for safely adopting agentic AI frameworks are just e
GeneralYour AI service just returned an empty response. No error code. No stack trace. The model simply decided not to answer. Traditional debugging assumes deterministic behavior — same input, same output.
GeneralScope This guide outlines immediate measures to secure GitHub repositories following the Megalodon campaign, which compromised over 5,500 repositories in six hours. You ll find detection workflows, cr
GeneralScope This guide focuses on detecting and responding to supply chain attacks targeting email transmission libraries. You ll learn to identify BCC-based exfiltration backdoors in npm packages, implemen
GeneralMicrosoft has released Rampart and Clarity as open-source projects, offering new ways for organizations to enhance AI agent security. These tools address a critical issue: AI agents now execute code,
GeneralThe Conventional Wisdom Security teams are excited about Microsoft s release of Clarity and RAMPART, viewing them as transformative for AI security. The idea is straightforward: integrate these open-s
GeneralSecurity engineers have spent decades developing reliable methods to measure software security. However, with the advent of AI systems, these measurements have become ineffective. The issue isn t that
GeneralYour AI agent just guided a developer through installing a malicious package. Your static analysis tools found nothing wrong. Your endpoint detection and response (EDR) didn t trigger. Your code revie
GeneralMicrosoft has released two open-source tools that transform AI agent security testing: RAMPART and Clarity. RAMPART is a Pytest-native safety and security testing framework, while Clarity serves as a
