Contributed Content
How to Move AI SRE Agents From Demo to Production
Andrey Pokhilko | | agentic AI, AI agents, AIOps, incident response, observability, site reliability engineeringAn AI agent that works on an engineer’s laptop can feel like a breakthrough. It can read logs, query observability tools, inspect cloud resources and connect a failed deployment to a bad ...
From Software Supply Chains to AI Vulnerabilities: Why Neither Solves Enterprise Linux Security
Moshe Bar | | enterprise security, Linux security, patch management, runtime protection, runtime security, vulnerability managementFor nearly a decade, cybersecurity has been dominated by one overarching concern: securing the software supply chain. Organizations invested heavily in Software Bills of Materials (SBOMs), artifact signing, provenance frameworks, reproducible builds, ...
A Semicolon in a Branch Name Was All It Took to Steal an AI Agent’s GitHub Token
Canio Campaniello | | AI agent security, command injection, credential security, GitHub security, least-privilege, OpenAI CodexAI coding agents don't just suggest code anymore. Tools like OpenAI's Codex spin up a real container, clone a real repository, and authenticate with a real GitHub credential to get the job ...
Dependency Mocking Approach That Gets More Accurate as Your Services Deploy More Often
Sancharini Panda | | API testing, CI/CD, Contract Testing, Dependency Mocking, devops, ebpf, integration testing, Keploy, microservices, Mock Drift, service virtualization, software testing, test automation, Testcontainers, Traffic-Based MockingTraffic-based dependency mocking turns frequent upstream deployments into opportunities to refresh mocks from real behavior and reduce integration test drift ...
Why Old Azure DevOps Releases Survive a Pipeline Cutover
Ahmed Tariq | | Azure DevOps, Azure DevOps Classic, Azure pipelines, CI/CD, container security, deployment automation, devops, devsecops, Helm, kubernetes, Kubernetes security, Pipeline Migration, release management, Release Pipelines, software deliveryOld Azure DevOps Classic releases can retain retired deployment tasks, Helm names, image paths and variables long after a pipeline cutover, leaving stale redeploy paths active ...
DevSecOps Teams as Partners in Secure Software Delivery
Manish Shetty | | application security, CI/CD, CI/CD security, dependency security, devops security, devsecops, risk management, secure software development, security automation, Security Guardrails, shift left security, software security, Software Supply Chain, vulnerability managementDevSecOps teams can reduce last-minute release delays by shifting security decisions earlier, improving guardrails, clarifying ownership and making findings actionable ...
Why Plan Review Stopped Working
Mariusz Michalowski | | AI agents, gitops, IaC, infrastructure as code, infrastructure automation, policy as codeThe control that held your infrastructure together was plan review, meaning a person reading a diff and deciding whether to approve it. Not the policy document and not the pipeline configuration. It ...
What I Learned Building Cloud-Portable Services Across Multiple Providers
Sandeep Pal | | Alibaba Cloud, AWS, cloud abstraction, Cloud APIs, cloud architecture, cloud infrastructure, cloud portability, cloud SDKs, cloud-native development, conformance testing, developer experience, devops, Google Cloud, IDP, internal developer platforms, kubernetes, Multi-cloud, platform engineering, vendor lock-in, WireMockMulti-cloud strategies often stumble over provider-specific behavior. A layered abstraction built on official SDKs can normalize differences while preserving access to valuable native capabilities ...
The Observability Tax: When Monitoring Costs Exceed Downtime Costs
Muhammad Yawar Malik | | cloud costs, data retention, devops, Distributed Tracing, FinOps, incident response, infrastructure monitoring, logs, metrics, observability, observability costs, observability strategy, OpenTelemetry, platform engineering, SRE, telemetry, telemetry costs, tracesObservability costs can spiral when teams collect more telemetry than they actually use. A more mature approach prioritizes the data that directly improves incident detection, diagnosis and recovery ...
Why Shift Left is Dead
Devin Maguire | | ADLC, agentic development lifecycle, AI Governance, AI guardrails, AI security, AI-Driven Development, AI-generated code, application security, Developer Security, devsecops, prompts, sdlc, secure software development, shadow ai, shift left security, Software Supply Chain SecurityAI-driven development is exposing risks before code is written, forcing security teams to move beyond shift-left and govern agents, prompts, tools and data across the entire development lifecycle ...
IT Outsourcing Versus In-House Development
Sambhav Aggarwal | | AI-assisted development, cloud infrastructure, Cybersecurity, developer productivity, devops, DevOps outsourcing, digital transformation, engineering costs, engineering strategy, engineering teams, global talent, hybrid teams, in-house development, IT outsourcing, product development, QA outsourcing, scalable development, software delivery, software development, software engineering, software outsourcing, software partners, technical talent, time to marketThe debate isn't new — but the stakes are. In 2026, the gap between companies that get this decision right and those that don't is measured in product cycles, burn rate, and ...
Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface
Muhammad Yawar Malik | | application security, build agents, build pipelines, CI/CD security, Cloud Security, credential security, dependency security, deployment security, devops security, devsecops, ephemeral runners, GitHub Actions, infrastructure security, Jenkins security, least-privilege, pipeline security, provenance attestation, secrets management, secure pipelines, secure software development, software provenance, Software Supply Chain, supply chain attacks, third-party actions, XZ UtilsCI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern DevOps ...
