Expert perspectives on application security, compliance, and emerging threats
ResearchFive days after PHP2Shell disclosure, 93.6% of PHP systems remained vulnerable due to common patching mistakes that hinder swift remediation.
ResearchDiscover tactics behind npm supply chain attacks targeting crypto and Web3 teams. Learn verification and security steps to protect your AI and npm dependencies.
ResearchOn September 16, two GitHub Actions repositories involved in the Mini Shai-Hulud supply-chain attack were reactivated with their malicious payloads intact. They remained compromised for nine days. If
ResearchYour development team adopted AI coding assistants six months ago. Velocity increased, developers are happy, and you ve seen no obvious security incidents. But here s what you probably don t know: tho
Get weekly security insights and compliance updates delivered to your inbox.
ResearchYour compliance team hands you a spreadsheet with 247 controls from three different frameworks. Your job: map them to your CI/CD pipeline, container runtime, and secrets management system. The spreads
ResearchThe Challenge If your team uses AI coding agents, you might be overlooking a hidden cost: the data formats your tools output. When you send Sonar CLI results to an LLM for code analysis, you re paying
ResearchA Harvard Business School study tracking GitHub activity reveals something your security team needs to see: developers using Copilot increased their coding time by 12.4%, while their project managemen
ResearchResearch presented at RSAC 2026 highlights a significant issue: Model Context Protocol (MCP) introduces architectural vulnerabilities in LLM environments that can t be resolved with patches. Unlike a
ResearchYou ve got three AI-powered application security scanners running against your codebase. Scanner A flags 127 issues. Scanner B finds 89. Scanner C reports 156. They agree on exactly 5% of their findin
ResearchYour developers are installing AI coding assistants that execute with full system permissions. No runtime checks. No sandboxing. Just direct access to everything on their machines. Mobb.ai s recent au
ResearchYou ve likely seen the pitch: AI will transform your vulnerability management, speed up triage, and catch threats before humans can. What vendors don t mention is that adding AI to a flawed security m
ResearchWhen you deploy an AI bot into production, you re making an implicit promise about where the security boundary lies. Does each bot instance run with unique credentials? Does a compromise affect one us
ResearchUnderstanding the AI Usage Disparity Akamai s State of the Internet: Enterprise AI Usage Risk Report 2026 highlights a critical issue: the top 5% of AI users in your organization engage with AI models
ResearchAbout six months ago, questions started popping up in our Slack channel. An engineer asked about ChatGPT usage policies. Another wondered how to scan AI-generated pull requests. Recently, a compliance
ResearchThe Internet Bug Bounty program has paused payouts after awarding over $1.5 million since 2012. The reason? AI-assisted research is transforming the landscape. This means your security team will face
ResearchYour AI coding assistant just added 47 dependencies to your project. You approved the PR because the feature works and the tests pass. Three months later, you re patching a critical vulnerability in a
