Expert perspectives on application security, compliance, and emerging threats
StandardsThe Challenge With the introduction of the EU Cyber Resilience Act , your compliance team faces a significant challenge: tracking and proving lifecycle management for every component in your software
StandardsYour employee receives an email about a critical security issue. Minutes later, someone claiming to be from IT calls to help resolve it. Eleven hours later, attackers have compromised nine additional
IncidentAI s Impact on Vulnerability Discovery In a 90-day period, an AI agent named XBOW submitted over 1,060 valid vulnerabilities to bug bounty programs, surpassing the combined efforts of thousands of hum
GeneralOn February 2nd, maintainers from npm, PyPI, crates.io, and Maven Central met for the first time to address security failures. The OpenSSF Package Manager Security Forum wasn t a celebration—it was a
Get weekly security insights and compliance updates delivered to your inbox.
IncidentWhat Happened Microsoft identified a campaign distributing malicious repositories disguised as legitimate Next.js projects. The attack exploited Visual Studio Code s workspace automation features to e
StandardsThe regulatory environment for software development has fundamentally changed in 2025. What was once guidance is now enforcement, and organizations treating compliance as a checkbox exercise face sign
IncidentWhat Happened In October 2024, security researchers at Zenity discovered a zero-click vulnerability in Perplexity s Comet AI browser. The flaw, named PerplexedComet, allowed attackers to inject malici
IncidentWhat Happened OpenClaw, a self-hosted AI platform, had a vulnerability that allowed malicious websites to hijack local instances through brute-force password attacks. The attack was simple: a user vis
StandardsThe Problem: Data Leakage in Federated Learning Your federated learning models might be leaking training data. Research by Carlini et al. shows that sensitive information, like social security numbers
GeneralThe Conventional Wisdom Security teams often view AI-powered vulnerability detection as an add-on to existing processes. You conduct static analysis, dynamic scans, and dependency checks, then perhaps
IncidentWhat Happened Truffle Security discovered nearly 3,000 Google Cloud API keys embedded in publicly accessible client-side code. These keys provided unauthorized access to Google s Gemini API endpoints,
StandardsScope - What This Guide Covers This guide explains how to prepare your security program for NIST s forthcoming AI-specific control overlays, building on NIST SP 800-53 Rev 5 and the NIST Cybersecurity
GuidesThe EU Cyber Resilience Act (CRA) is now a concrete reality. Your organization needs clear processes to translate these regulatory obligations into actionable engineering tasks. This template provides
LegalYour team adopts Secure by Design principles. You create a security champion program, add threat modeling to your sprint planning, and mandate security reviews before deployment. Six months later, vul
StandardsScope - What This Guide Covers This guide explores how the 2025 OWASP Top 10 update impacts your security engineering practices when using AI coding assistants, deploying AI-powered features, or integ
GeneralThe myths around federal software supply chain security persist because they re comfortable. They let you treat authorization as a one-time event, vulnerabilities as a scoring exercise, and compliance
