Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1439 Security Engineers1020 Compliance Teams274 DevOps Leaders88 Developers33 CISOs21 IT Directors2

Topics:All1439 Incident911 General269 Standards94 Research87 Guides53 Deadlines17 Vendor News5 Legal2

1439 articlesSort byNewest·Trending

AI Agents Ran Malicious Code from Git Configs

Incident

Latest

4 min read

AI Agents Ran Malicious Code from Git Configs

When you clone a repository, you expect your AI coding assistant to help write code. You don t expect it to execute an attacker s commands without asking. That s exactly what happened with eight vulne

For Security EngineersRead article

Agent Context Poisoning Is Now a CVE Category

General

5 min read

Agent Context Poisoning Is Now a CVE Category

The OpenSSF Tech Talk on March 17, 2026, at 1:00 PM ET marks a significant shift in classifying AI security vulnerabilities. Angela McNeal will discuss agent autonomy and context integrity as new secu

For Security EngineersRead

Agent-Led vs. Developer-Led: A Task Allocation Framework

General

5 min read

Agent-Led vs. Developer-Led: A Task Allocation Framework

Scope: What This Guide Covers This guide helps you allocate tasks between AI coding agents and human developers. If you re integrating AI coding tools into your development workflow, you need a system

For DevOps LeadersRead

AI Agents Built Two Apps, Introduced 143 Vulnerabilities

Incident

4 min read

AI Agents Built Two Apps, Introduced 143 Vulnerabilities

What Happened DryRun Security tested three AI coding agents, OpenAI Codex GPT 5.2, GitHub Copilot Workspace, and Replit Agent, on two application builds. The agents generated code for a task managemen

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

General

5 min read

AI Won't Fix Your Deployment Pipeline

You ve probably heard the pitch: replace your error-prone human developers with AI agents, and watch your delivery problems disappear. No more miscommunication, no more merge conflicts, no more late-n

For DevOps LeadersRead

Attackers Mint Admin Tokens Four Days After JFrog Patch

Incident

4 min read

Attackers Mint Admin Tokens Four Days After JFrog Patch

What Happened On August 28, 2026, JFrog released Artifactory version 7.161.20 to patch CVE-2026-82329 , an authentication bypass vulnerability with a CVSS score of 9.8. Just four days later, on Septem

For Security EngineersRead

Your Team Asked: How Do We Actually Govern Shadow AI?

Guides

4 min read

Your Team Asked: How Do We Actually Govern Shadow AI?

Last week, three different Slack threads raised similar concerns. A developer questioned if ChatGPT was a sanctioned tool. An engineer wondered if copying code into Claude breached data handling polic

For Security EngineersRead

Traditional Threat Modeling Won't Secure Your LLMs

General

4 min read

Traditional Threat Modeling Won't Secure Your LLMs

The conventional wisdom : Your existing threat modeling framework will work fine for AI systems. Just add LLM-specific threats to your STRIDE analysis, update your data flow diagrams, and you re cover

For Security EngineersRead

Should You Adopt the OWASP LLM Checklist?

Standards

5 min read

Should You Adopt the OWASP LLM Checklist?

You re facing a decision: your organization is deploying LLMs, and you need to secure them. The OWASP LLM AI Cybersecurity Governance Checklist offers a structured six-step approach to LLM strategy. B

For Compliance TeamsRead

Sonar CLI Cut Token Costs 49% With Format Change

Research

4 min read

Sonar CLI Cut Token Costs 49% With Format Change

The Challenge If your team uses AI coding agents, you might be overlooking a hidden cost: the data formats your tools output. When you send Sonar CLI results to an LLM for code analysis, you re paying

For DevOps LeadersRead

npm Malware Broke 500 Packages in Four Days

Standards

5 min read

npm Malware Broke 500 Packages in Four Days

Your package manager trusts every update it receives. That trust just became your biggest vulnerability. Between September 14th and 18th, the Shai-Hulud worm altered more than 500 package versions on

For Security EngineersRead

Cursor's Security Review Automation: What Went Right

Incident

4 min read

Cursor's Security Review Automation: What Went Right

Cursor s security review system identifies over 200 vulnerabilities weekly across 3,000+ internal pull requests. This isn t a security incident; it s a testament to effective automation. It highlights

For Security EngineersRead

AI Agents Don't Need Exploits to Leak Data

General

5 min read

AI Agents Don't Need Exploits to Leak Data

You ve probably invested in prompt injection defenses, model guardrails, and access controls for your AI deployments. Your security checklist looks solid. But here s what most teams miss: the gap betw

For Security EngineersRead

Agentic AI Cuts Threat Response from Days to Minutes

Incident

3 min read

Agentic AI Cuts Threat Response from Days to Minutes

Introduction In 2026, Frost Sullivan recognized Picus Security as the Innovation Index Leader in their Frost Radar report on Automated Security Validation. This accolade wasn t for minor tweaks to exi

For Security EngineersRead

Active Traceability for Software Supply Chains

General

4 min read

Active Traceability for Software Supply Chains

Scope This guide covers implementing active traceability systems in software supply chains, focusing on the security and governance challenges introduced by AI-assisted development. You ll find requir

For Security EngineersRead

7,100 Rails Instances Running Known RCE Flaws

Incident

4 min read

7,100 Rails Instances Running Known RCE Flaws

A vulnerability in Ruby on Rails libvips image processing library (CVE-2026-66066) has been actively exploited since early March 2024. VulnCheck recorded more than 360 exploitation attempts within the

For Security EngineersRead

Showing 33-48 of 1439 articles

PreviousPage 3 of 90Next