Insights & Analysis

Expert perspectives on application security, compliance, and emerging threats

All Teams1115 Security Engineers770 Compliance Teams229 DevOps Leaders65 Developers31 CISOs17 IT Directors2

Topics:All1115 Incident716 General194 Standards88 Research61 Guides36 Deadlines13 Vendor News4 Legal2

1115 articlesSort byNewest·Trending

"We generate SBOMs, but nobody looks at them" — fixing the gap between SBOM creation and action

Standards

Latest

5 min read

"We generate SBOMs, but nobody looks at them" — fixing the gap between SBOM creation and action

Teams often find themselves generating Software Bill of Materials (SBOMs) without knowing how to use them effectively. They might have set up SBOM tooling in their CI/CD pipeline, generating thousands

For DevelopersRead article

When Static Scans Miss the Exploit Path: A Shift-Left Failure

Incident

5 min read

When Static Scans Miss the Exploit Path: A Shift-Left Failure

What Happened Your team might face a critical vulnerability in production that your CI/CD security pipeline had previously scanned and cleared. Consider a SQL injection flaw in a user authentication e

For DevOps LeadersRead

Best Buy Cut False Positives 80% by Moving Security Into the IDE

Standards

4 min read

Best Buy Cut False Positives 80% by Moving Security Into the IDE

The Challenge Security scanning tools often generate excessive noise. Your team is likely familiar with this issue. A typical enterprise application security (AppSec) program runs static application s

For Compliance TeamsRead

Implementing Security for AI-Assisted Development: A Working Playbook

Standards

5 min read

Implementing Security for AI-Assisted Development: A Working Playbook

Your security measures are outdated for a development process that has evolved. When AI agents continuously write code—not in sprints or releases—traditional security practices like quarterly pen test

For Security EngineersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

When AppSec Teams Treat Every Critical Alert the Same

Research

5 min read

When AppSec Teams Treat Every Critical Alert the Same

Your SAST scanner flags 47 critical vulnerabilities overnight. Your SCA tool adds 23 more. Your IaC scanner contributes another 15. By 9 AM, you re staring at 85 critical findings, and you know from e

For Security EngineersRead

When AI Found 500 Vulnerabilities Nobody Asked For

Standards

5 min read

When AI Found 500 Vulnerabilities Nobody Asked For

The Challenge Anthropic s Claude Code Security identified over 500 previously unknown high-severity vulnerabilities in open-source codebases. While this might seem like a win for security teams, it pr

For Security EngineersRead

Two Years of AI Infrastructure Exploitation: What Wiz Researchers Found

Incident

3 min read

Two Years of AI Infrastructure Exploitation: What Wiz Researchers Found

Overview of Findings Security researchers at Wiz spent two years examining AI infrastructure deployments to uncover exploitable vulnerabilities. Their findings reveal that while many teams focus on pr

For Security EngineersRead

AI Coding Tools Just Became Your Supply Chain's Weakest Link

Standards

5 min read

AI Coding Tools Just Became Your Supply Chain's Weakest Link

Your AI coding assistant just installed a malicious package. Not because it s compromised—because it made a typo. The SANDWORM_MODE campaign shows how AI tools like Claude Code and OpenClaw have becom

For Security EngineersRead

Developer Security Intelligence Configuration Template

Guides

4 min read

Developer Security Intelligence Configuration Template

Security teams invest significant time building threat intelligence feeds, vulnerability scanners, and policy engines, only to see developers overlook them due to separate dashboards and context-switc

For Security EngineersRead

Dependency Management When AI Writes Half Your Code

Standards

5 min read

Dependency Management When AI Writes Half Your Code

Your AI coding assistant just suggested a library. Your developer accepted it. Your codebase now includes a new dependency with 47 transitive dependencies, three of which have known CVEs. This happene

For Compliance TeamsRead

When Your AI Coding Assistant Becomes an Exfiltration Tool

Incident

4 min read

When Your AI Coding Assistant Becomes an Exfiltration Tool

Incident Overview Orca Security discovered RoguePilot, a vulnerability in GitHub Codespaces that allowed attackers to manipulate GitHub Copilot into leaking GITHUB_TOKEN credentials. Attackers embedde

For Security EngineersRead

AI Will Fix Your Vulnerabilities Automatically: Five Myths From the DARPA Challenge

General

5 min read

AI Will Fix Your Vulnerabilities Automatically: Five Myths From the DARPA Challenge

The AI Cyber Challenge concluded after two years of competition between DARPA, ARPA-H, and OpenSSF. Now, teams are assessing what their cyber reasoning systems can achieve in real-world environments.

For Security EngineersRead

70% of Critical Vulns Come From Memory Issues — Here's What One Team Actually Did

Standards

4 min read

70% of Critical Vulns Come From Memory Issues — Here's What One Team Actually Did

The Challenge A platform engineering team managing a 15-year-old C++ codebase faced a directive from their CISO: reduce memory-safety vulnerabilities by Q3 or plan a multi-year rewrite. The system pro

For DevelopersRead

Should You Block AI Automation Frameworks Before They're Weaponized?

Research

5 min read

Should You Block AI Automation Frameworks Before They're Weaponized?

The Question at Hand Your security team has flagged a new AI automation framework in your environment. It s early-stage, popular in the community, and there s no confirmed exploitation yet. Should you

For Security EngineersRead

Open Source Contributions Return 2-5x Investment While Passive Consumption Bleeds $670K Annually

Standards

4 min read

Open Source Contributions Return 2-5x Investment While Passive Consumption Bleeds $670K Annually

The Linux Foundation has quantified a crucial insight for engineering teams: your open source strategy can either multiply your investment or quietly drain your budget. Organizations that actively con

For Compliance TeamsRead

Implementing Non-Human Identity Management for AI Systems

Standards

6 min read

Implementing Non-Human Identity Management for AI Systems

Your AI deployment just created 847 new service accounts, API keys, and machine credentials. Your security team discovered 312 of them three months later during an incident response. This gap between

For Compliance TeamsRead

Showing 1009-1024 of 1115 articles

PreviousPage 64 of 70Next