Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams33 Security Engineers1021 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All33 Incident912 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

33 articles in Security Engineers · Standards · Clear filtersSort byNewest·Trending

npm Malware Broke 500 Packages in Four Days

Standards

Latest

5 min read

npm Malware Broke 500 Packages in Four Days

Your package manager trusts every update it receives. That trust just became your biggest vulnerability. Between September 14th and 18th, the Shai-Hulud worm altered more than 500 package versions on

For Security EngineersRead article

OWASP Top 10 for LLM Apps: Your Integration Checklist

Standards

6 min read

OWASP Top 10 for LLM Apps: Your Integration Checklist

The OWASP Top 10 for LLM Applications got a major update in late 2024. Unlike the classic OWASP Top 10 for web apps, this framework addresses risks unique to large language models: prompt injection, d

For Security EngineersRead

AI Finds the Bugs. Should AI Fix Them Too?

Standards

5 min read

AI Finds the Bugs. Should AI Fix Them Too?

You re staring at a vulnerability backlog that s grown 40% in six months. Your scanning tools flag more issues every sprint. Security researchers are using AI to discover edge cases you ve never seen

For Security EngineersRead

LLM Risk Assessment Template: 6,639 Incidents Edition

Standards

5 min read

LLM Risk Assessment Template: 6,639 Incidents Edition

The OWASP GenAI Security Project has transformed how you should evaluate AI risks. Their 2026 Top 10 for LLM Applications uses data from 6,639 real incidents, not just expert opinion. If you re still

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

AI Agent Security: Your Pre-Production Checklist

Standards

5 min read

AI Agent Security: Your Pre-Production Checklist

If you re deploying AI agents that make decisions, execute code, or access production systems, you need governance controls before they go live. Microsoft s recent release of the Agent Governance Tool

For Security EngineersRead

What Should I Actually Fix First? API Security Top 10 FAQ

Standards

4 min read

What Should I Actually Fix First? API Security Top 10 FAQ

These questions arise when someone discovers the OWASP API Security Top 10 2023 (released June 5, 2023), and their team is already deploying new endpoints. They re trying to understand what Broken Obj

For Security EngineersRead

Machine Identity Governance: A Security Engineer's Reference

Standards

5 min read

Machine Identity Governance: A Security Engineer's Reference

Scope - What This Guide Covers This guide focuses on implementing machine identity security programs. You ll find specific controls for service accounts, API keys, certificates, tokens, and AI agents

For Security EngineersRead

Setting Up AI-Powered Vulnerability Scanning After Mozilla's Claude Mythos Success

Standards

5 min read

Setting Up AI-Powered Vulnerability Scanning After Mozilla's Claude Mythos Success

Mozilla scanned Firefox using Opus 4.6, then gave Claude Mythos access to the codebase. The AI model identified 271 vulnerabilities in Firefox 150. This was not a research project or a proof of concep

For Security EngineersRead

Repository Lockdown Runbook: Your First-Hour Response Template

Standards

5 min read

Repository Lockdown Runbook: Your First-Hour Response Template

When you discover unauthorized access to your GitHub organization, the first 60 minutes determine whether you contain the breach or watch it spread to every downstream dependency. This runbook provide

For Security EngineersRead

Hardening Open-Source Maintainer Accounts After the Axios Compromise

Standards

4 min read

Hardening Open-Source Maintainer Accounts After the Axios Compromise

The compromise of the Axios npm package through social engineering highlights a critical vulnerability in the software supply chain: the security of your dependencies is only as strong as the people w

For Security EngineersRead

AI Package Repositories Just Got Weaponized: What the Xinference Attack Reveals

Standards

4 min read

AI Package Repositories Just Got Weaponized: What the Xinference Attack Reveals

On April 22, 2026, malicious versions of xinference appeared on PyPI, targeting AI inference servers with credential theft payloads that leave no persistent traces. This attack marks a tactical shift:

For Security EngineersRead

Standards

Malicious npm Package Impersonates Bitwarden CLI: Three Attack Vectors in One

On April 23, 2026, Mend.io discovered a compromised package on npm masquerading as @bitwarden/cli version 2026.4.0. This package combined three attack mechanisms: a self-propagating npm worm, a GitHub

For Security EngineersRead

A Self-Propagating Worm Just Proved Your Dependency Security Model Is Broken

Standards

4 min read

A Self-Propagating Worm Just Proved Your Dependency Security Model Is Broken

Socket and StepSecurity detected a supply chain worm in npm packages that doesn t just steal credentials—it spreads itself. The attack, tracked as CanisterSprawl, uses postinstall hooks to exfiltrate

For Security EngineersRead

"We're drowning in CVEs" — What NIST's triage shift means for your vulnerability program

Standards

4 min read

"We're drowning in CVEs" — What NIST's triage shift means for your vulnerability program

Your team likely relies on the NVD scores to decide what to patch, with automation pulling CVSS data to prioritize remediation. Now, NIST is shifting its focus, having enriched nearly 42,000 CVEs in 2

For Security EngineersRead

NIST Just Handed You the CVE Problem—Here's What Happened Next

Standards

5 min read

NIST Just Handed You the CVE Problem—Here's What Happened Next

The Challenge Between 2020 and 2023, CVE submissions grew 263%. Last year alone, NIST enriched almost 42,000 CVEs—a 45% year-over-year increase. Then NIST announced it would no longer analyze every vu

For Security EngineersRead

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Standards

4 min read

Integrating AI Vulnerability Scanners Into Your Security Pipeline

Your vulnerability management program is about to undergo a significant transformation. AI models that autonomously discover vulnerabilities at scale are now production tools. Your team needs a deploy

For Security EngineersRead

Showing 1-16 of 33 articles

PreviousPage 1 of 3Next