Surprise! Everybody Uses AI Tools for Software Development, Few Do So Securely
AI is generating code faster than teams can secure it, widening software supply chain risk and exposing major gaps in AppSec and governance.
Crates.io Removes Malicious Rust Package Targeting Web3 Developers
A malicious Rust package that was found to be downloading payloads aimed at stealing cryptocurrency was removed from the crates.io Rust package registry, along with another package by the same author that appeared benign but was dependent on the first. The crates.io team removed both packages this week after security researchers with Socket alerted it […]
It’s Time to Rethink Access Control for Modern Development Environments
As development environments evolve at breakneck speed, our approach to securing them remains stuck in the past. I’ve watched countless organizations implement robust Identity and Access Management (IAM) solutions, deploy Identity Governance and Administration (IGA) tools, and then breathe a collective sigh of relief, believing they’ve solved their access control challenges. But have they? An […]
What Fuels AI Code Risks and How DevSecOps Can Secure Pipelines
Modern development teams are under constant pressure to deliver fast, innovate continuously, and stay clear of security threats; all at the same time. Every new feature, every accelerated release, carries the hidden risk of introducing vulnerabilities that can slip past traditional check points. Even the most seasoned developers can unknowingly leave gaps that put applications […]
How Cybersecurity Teams Can Work Better with DevOps
DevOps teams move fast, but security can lag without the right approach. Often, cybersecurity and DevOps teams work separately, and that could lead to problems. To fix this, organizations must shift from viewing security as a checkpoint to embedding it in DevOps at every step. This article explores how to infuse security in DevOps from […]
Survey Surfaces Rising Tide of Vulnerabilities in Code Generated by AI
A survey of 450 IT professionals in the U.S. and Europe finds 69% of organizations have discovered vulnerabilities in code generated by artificial intelligence (AI) tools, with 20% reporting there has been a serious incident as a result. Conducted by Sapio Research on behalf of Aikido Security, a provider of a platform of discovering vulnerabilities […]
The Silent Technical Debt: Why Manual Remediation Is Costing You More Than You Think
Manual vulnerability remediation drains time, innovation, and security. Learn how intelligent remediation eliminates hidden technical debt and accelerates DevSecOps.
Survey Surfaces Widespread Adoption of AI to Improve DevSecOps
A global survey of 1,015 IT professionals with responsibility for application security finds more than three quarters (77%) are using artificial intelligence (AI), with another 13% considering adoption. Conducted by Fastly, a provider of a content delivery network (CDN) service, the survey also finds 25% of survey respondents using AI have fully integrated into their […]
Git Services Need Better Security. Here’s How End-to-End Encryption Could Help
A new study from the University of Sydney, UESTC, and Google introduces efficient end-to-end encryption for Git services like GitHub and GitLab. Learn how this breakthrough could secure your code repositories without slowing development.
Whose Ops is it Anyway? How IDPs, AI and Security are Evolving Developer Culture
It was only a few years ago that perhaps the biggest hurdle for DevOps advocates was convincing leadership that it was worth the investment. That conversation has since shifted. In most organisations today, the value of faster releases, tighter feedback loops, and closer collaboration between development and operations is obvious. The challenge is no longer […]
Worms in the Supply Chain: Shai-Hulud and the Next DevOps Reckoning
DevOps was supposed to make software delivery faster, safer and more reliable. For the most part, it has. But every so often, something nasty crawls out of the shadows and reminds us how fragile the system really is. It wasn’t a zero-day in Kubernetes or a cloud misconfiguration that caught my eye. It was a […]
The EU’s Cyber Resilience Act: Redefining Secure Software Development
The European Union’s Cyber Resilience Act (CRA) marks a turning point for anyone building, selling, or maintaining digital products. Whether it’s enterprise software, consumer apps, IoT devices, or embedded systems, the CRA sets rigorous cybersecurity requirements that apply throughout a product’s entire lifecycle, from design and development to deployment, maintenance, and secure decommissioning. At its […]
HoundDog.ai Code Scanner Shifts Data Privacy Responsibility Left
HoundDog.ai today made generally available a namesake static code scanner that enables security and privacy teams to enforce guardrails on sensitive data embedded in large language model (LLM) prompts or exposed artificial intelligence (AI) data sinks, such as logs and temporary files, before any code is pushed to production. Company CEO Amjad Afanah said the […]
“Shove Left” – Dumping Downstream Tasks Onto Developers – A Recipe for Failure
Beware the “Shove Left” anti-pattern. Simply dumping downstream tasks onto developers without changing the system is a recipe for burnout, inefficiency and failure.
Survey Surfaces Significant Lack of Visibility Into Software Supply Chain Risks
A global survey of 1,500 C-suite and senior executives published today finds about half (49%) concede their organization lacks the visibility needed to fully understand – or even identify – software supply chain risks.
Why DevSecOps Isn’t a Thing Yet
One of the biggest obstacles to DevSecOps adoption is the cultural gap between development, security, and operations teams.
Shift Left Alone is No Longer Enough, Runtime Context is Key
For a long time, security teams have been told that shifting left is the key to securing their apps and systems. And until recently, this was (mostly) sufficient. As long as security experts were included early enough in the development process, it worked to ensure that security awareness starts at the development and even design […]
JFrog Extends Alliance With NVIDIA to Secure AI Software Supply Chain
JFrog and NVIDIA today announced they have expanded the integrations between their software development platforms to now include the Enterprise AI Factory, a set of frameworks and blueprints for building artificial intelligence (AI) applications. As a result, software artifacts created using the NVIDIA Enterprise AI Factory can be housed in the JFrog Software Supply Chain […]
DevEx Got You This Far: What’s Next for True DevSecOps Maturity?
The journey toward integrating security into the fast-paced world of DevOps has seen significant strides, largely thanks to a much-needed focus on the developer experience (DevEx). Collectively, the AppSec community and industry have moved mountains in making security tools less intrusive, integrating them into developer workflows, and acknowledging that developers need security as a help, […]
Checkmarx Surfaces Malicious Effort to Compromise Software Supply Chains
Checkmarx, this week, reported it has discovered malicious software packages that, in addition to injecting malware capable of bypassing endpoint security to exfiltrate data, also provide persistent remote access and control of desktops and servers.
Futurum Group Survey Surfaces DevSecOps Progress on Multiple Fronts
A survey of 110 security leaders finds all are investing in software supply chain security, with application security posture management (ASPM) and DevSecOps automation and orchestration topping the priority list, followed closely by security composition analysis (SCA) tools, application programming interface (API) security and dynamic application security testing (DAST) tools. In addition, 30% of respondents […]
Simplifying Authorization at Scale: The Importance of DevOps Workflows with Flexible, Scalable and Secure Access Control
DevOps has transformed how developers build, deploy, and manage infrastructure and applications, making automation, scalability and rapid iteration core to modern development workflows. While much of the software delivery process has evolved, authorization has largely remained stuck in legacy approaches. Many organizations still manage homegrown solutions with hardcoded permissions across services, custom policies by different teams, […]
Continuous Compliance for Cloud-Native CI/CD Pipelines
How DevOps teams can embed auditability without sacrificing delivery speed.