Expert perspectives on application security, compliance, and emerging threats
GeneralYour compliance team just got handed another attestation framework. You re already collecting SBOMs, signing artifacts, and running policy checks across four CI/CD platforms. Now someone wants to add
GeneralThe Conventional Wisdom Your SIEM is firing alerts: failed sign-ins, unrecognized client IDs. Your team triages them one by one, checking if each event crosses a threshold. Five failed attempts? Inves
GeneralYou ve turned on Dependabot alerts. You re patching CVEs. But are you catching malware in your dependencies before it ships? GitHub s Dependabot now pulls malware intelligence from OpenSSF s malicious
GeneralYou can t shut down what you can t see. A bipartisan bill now requires certain AI companies to maintain the ability to shut down, throttle, or suspend their models. The Department of Homeland Security
Get weekly security insights and compliance updates delivered to your inbox.
GeneralYou ve probably heard that disabling lifecycle scripts in your package manager is a good idea. After all, the npm worm that targeted [email protected] and spread to 353 compromised versions across 79 package
GeneralSecurity engineers remember the cloud migration chaos of 2010-2015. Teams launched instances without tagging, routing, or cost controls. Six months later, the AWS bill arrived, and everyone panicked.
GeneralYour team is probably using AI coding assistants like GitHub Copilot or Amazon CodeWhisperer. These tools promise to speed up development and automatically fix bugs. The pitch is compelling: let AI ha
GeneralScope This guide outlines the security measures your team needs when AI agents interact with your repositories, code review processes, and contributor workflows. It includes technical defenses and hum
GeneralBetween July 26 and August 3, 2026, Open VSX hosted 77 malicious extensions designed to impersonate legitimate developer tools and steal system data. Manifold Security identified the threat, and the m
GeneralYour AI applications are now critical to your operations. Your LLM-powered features handle customer data, your code assistants influence every pull request, and your chatbots make decisions that affec
GeneralThe conventional wisdom : You need human code reviews before shipping to production. Every commit requires at least one pair of eyes. It s how you catch bugs, maintain standards, and prevent incidents
GeneralThe Conventional Wisdom Your compliance program already manages non-human access. Service accounts get reviewed quarterly, API keys rotate every 90 days, and you ve got privileged access management to
GeneralYour identity management system wasn t built for entities that never log out, don t use MFA, and operate 24/7 with probabilistic reasoning. Here s what the data shows and what you need to change. What
GeneralScope This guide focuses on EKS s approach to Kubernetes control plane upgrades using three key capabilities: Extended Support, Upgrade Insights, and Version Rollback. You ll learn how to make version
GeneralYour security team just approved a new AI-powered code review tool. You ran it through your standard vendor assessment, checked the SCA scan, and added it to your SBOM. You re covered, right? Not even
GeneralCISA just released updates to its SBOM guidance. Your compliance team is probably updating templates right now. But here s the question: will any of this actually reduce your supply chain risk? The ho
