Tag

Application Security

165 articles

Latest in Application Security

Blogs

Black Duck Adds AI Agent to Triage and Fix Vulnerabilities

Black Duck this week added an artificial intelligence (AI) agent to its portfolio that triages vulnerabilities and then generates and validates fixes for DevSecOps teams to review before applying them. Patrick Carey, vice presiden…

Oct 30, 20263 min

All Application Security Articles

Showing 1–24 of 165

Oct28

Blogs

Rethinking Application Updates: Solutions for Faster, More Efficient CVE Patching

Slow CVE patching leaves applications exposed. Discover how buildpacks, shared components and AI agents can accelerate vulnerability remediation.

3 min

Oct26

Blogs

AI Made Building Apps Easy, but Who Really Runs Them?

A few months ago, a product manager at an agency reached out to us. They had built a client reporting app over a weekend using an AI coding tool and made it live so customers could…

3 min

Oct20

AI Agents Can Now Take Software Apart. DevOps Teams Need a Plan

AI-powered reverse engineering is making it easier to understand and rebuild software without source code. Tools such as REA and increasingly capable AI models create opportunities…

3 min

Oct20

GitHub Brings AI Security Scanning to Pull Requests CodeQL Can’t Cover

GitHub’s AI Scan brings AI-powered vulnerability detection to pull requests involving languages, scripts and infrastructure files beyond CodeQL’s existing coverage. Paired with the…

3 min

Oct07

Blogs

HackerOne Report Surfaces Massive Increase in Vulnerability Backlogs

HackerOne research shows vulnerability remediation is getting faster, but AI-driven discovery is expanding exposure debt even more quickly, putting DevSecOps teams under growing pr…

3 min

Oct06

Blogs

Security Teams Are Fixing Vulnerabilities Faster Than Ever. So Why Is Software Getting Riskier?

AI is speeding up dependency decisions, making point-of-selection security essential for reducing vulnerable components, downstream tickets and avoidable rework.

3 min

Sep28

Docker Introduces Open Sandbox Kit Spec for AI Agent Permissions

AI agents are getting good at probing the boundaries developers put around them. Their ability to improvise makes them hard to contain. “You ask for something in a very high-level,…

3 min

Sep28

Blogs

GitHub’s Security Autofix Agent Now Remembers What It Fixed

GitHub’s agentic autofix now uses Copilot Memory to reuse repository-specific security fix patterns, helping Copilot apply lessons from past vulnerabilities across future alerts, r…

3 min

Sep25

Blogs

Leaked GitLab Email Tokens Can Reach Code, Secrets and CI/CD Pipelines

Security researchers have uncovered a GitLab behavior that could let attackers use a leaked project email address to push code, trigger CI/CD jobs and reach other repositories acce…

3 min

Sep25

Blogs

DevSecOps Teams as Partners in Secure Software Delivery

DevSecOps teams can reduce last-minute release delays by shifting security decisions earlier, improving guardrails, clarifying ownership and making findings actionable.

3 min

Sep23

Blogs

Why Shift Left is Dead

AI-driven development is exposing risks before code is written, forcing security teams to move beyond shift-left and govern agents, prompts, tools and data across the entire develo…

3 min

Sep21

Blogs

Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent

Two patched OpenAI Codex vulnerabilities, Heapjack and Overpatch, exposed how coding agents can escape sandboxes and reach developer systems without approval prompts.

3 min

Sep18

Blogs

Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface

CI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern…

3 min

Sep15

Blogs

Stop Chasing 100% Test Coverage: Why DevOps Teams Need to Test Smarter, Not More

Every software team eventually runs into the same question: How much testing is enough? For years, the default answer has been “more.” More automated tests. More regression suites.…

3 min

Sep11

Blogs

GitHub Widens the Door on Advanced Security Trials

GitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free.

3 min

Sep10

Blogs

Why AI Agents Shouldn’t Guess at Vulnerability Exploitability

Vulnerability prioritization is not a language problem. The safest agent architectures use models to interpret and explain, while deterministic systems traverse the evidence. Ask a…

3 min

Aug31

Broadcom Launches Trusted Artifact Service for Spring Framework

Broadcom launches TrueSource Trusted Artifacts to provide hardened Spring dependencies, secure open source packages and automated vulnerability remediation.

3 min

Aug25

Blogs

Report Shines Spotlight on 91 Vulnerabilities Fixed in Latest Update to Spring Framework

Sonatype says 91 Spring vulnerabilities affecting more than 209,000 software components highlight how AI is accelerating vulnerability discovery and creating a new patching challen…

3 min

Aug24

Why “Tokenmaxxing” Was Always the Wrong Way for Developers to Measure AI Productivity

The term “tokenmaxxing” left the developer lexicon just as quickly as it arrived, and like most viral technology concepts, it means different things depending on who’s using it. In…

3 min

Aug19

Blogs

Are LLMs Equally Good (or Bad) at Building Secure Software?

An SCW study finds a large variance in how frontier and budget LLMs perform across different frameworks, and explains the striking cost variance.

3 min

Aug18

Blogs

Cloudsmith Extends Policies and Controls to Secure Application Binaries

Cloudsmith this week revealed it has expanded the policy management and continuous risk detection capabilities it makes available within its software artifact management platform t…

3 min

Aug13

Blogs

Production-Safe Testing: The Missing Piece in Most DevSecOps Strategies

Most DevSecOps teams invest heavily in security before deployment, yet attackers target the production environment where applications, APIs, and user behavior are constantly changi…

3 min

Aug12

Blogs

Why CI/CD Security Testing Is Going Autonomous (and Why It Should Stay Local)

Continuous integration and delivery changed the tempo of software. Teams merge dozens of times a day, infrastructure is redefined on every commit, and a new build can reach product…

3 min

Tag

Application Security

165 articles

Latest in Application Security

Blogs

Black Duck Adds AI Agent to Triage and Fix Vulnerabilities

Oct 30, 20263 min

All Application Security Articles

Showing 1–24 of 165

Oct28

Blogs

Rethinking Application Updates: Solutions for Faster, More Efficient CVE Patching

Slow CVE patching leaves applications exposed. Discover how buildpacks, shared components and AI agents can accelerate vulnerability remediation.

3 min

Oct26

Blogs

AI Made Building Apps Easy, but Who Really Runs Them?

A few months ago, a product manager at an agency reached out to us. They had built a client reporting app over a weekend using an AI coding tool and made it live so customers could…

3 min

Oct20

AI Agents Can Now Take Software Apart. DevOps Teams Need a Plan

AI-powered reverse engineering is making it easier to understand and rebuild software without source code. Tools such as REA and increasingly capable AI models create opportunities…

3 min

Oct20

GitHub Brings AI Security Scanning to Pull Requests CodeQL Can’t Cover

GitHub’s AI Scan brings AI-powered vulnerability detection to pull requests involving languages, scripts and infrastructure files beyond CodeQL’s existing coverage. Paired with the…

3 min

Oct07

Blogs

HackerOne Report Surfaces Massive Increase in Vulnerability Backlogs

HackerOne research shows vulnerability remediation is getting faster, but AI-driven discovery is expanding exposure debt even more quickly, putting DevSecOps teams under growing pr…

3 min

Oct06

Blogs

Security Teams Are Fixing Vulnerabilities Faster Than Ever. So Why Is Software Getting Riskier?

AI is speeding up dependency decisions, making point-of-selection security essential for reducing vulnerable components, downstream tickets and avoidable rework.

3 min

Sep28

Docker Introduces Open Sandbox Kit Spec for AI Agent Permissions

AI agents are getting good at probing the boundaries developers put around them. Their ability to improvise makes them hard to contain. “You ask for something in a very high-level,…

3 min

Sep28

Blogs

GitHub’s Security Autofix Agent Now Remembers What It Fixed

GitHub’s agentic autofix now uses Copilot Memory to reuse repository-specific security fix patterns, helping Copilot apply lessons from past vulnerabilities across future alerts, r…

3 min

Sep25

Blogs

Leaked GitLab Email Tokens Can Reach Code, Secrets and CI/CD Pipelines

Security researchers have uncovered a GitLab behavior that could let attackers use a leaked project email address to push code, trigger CI/CD jobs and reach other repositories acce…

3 min

Sep25

Blogs

DevSecOps Teams as Partners in Secure Software Delivery

DevSecOps teams can reduce last-minute release delays by shifting security decisions earlier, improving guardrails, clarifying ownership and making findings actionable.

3 min

Sep23

Blogs

Why Shift Left is Dead

AI-driven development is exposing risks before code is written, forcing security teams to move beyond shift-left and govern agents, prompts, tools and data across the entire develo…

3 min

Sep21

Blogs

Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent

Two patched OpenAI Codex vulnerabilities, Heapjack and Overpatch, exposed how coding agents can escape sandboxes and reach developer systems without approval prompts.

3 min

Sep18

Blogs

Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface

CI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern…

3 min

Sep15

Blogs

Stop Chasing 100% Test Coverage: Why DevOps Teams Need to Test Smarter, Not More

Every software team eventually runs into the same question: How much testing is enough? For years, the default answer has been “more.” More automated tests. More regression suites.…

3 min

Sep11

Blogs

GitHub Widens the Door on Advanced Security Trials

GitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free.

3 min

Sep10

Blogs

Why AI Agents Shouldn’t Guess at Vulnerability Exploitability

Vulnerability prioritization is not a language problem. The safest agent architectures use models to interpret and explain, while deterministic systems traverse the evidence. Ask a…

3 min

Aug31

Broadcom Launches Trusted Artifact Service for Spring Framework

Broadcom launches TrueSource Trusted Artifacts to provide hardened Spring dependencies, secure open source packages and automated vulnerability remediation.

3 min

Aug25

Blogs

Report Shines Spotlight on 91 Vulnerabilities Fixed in Latest Update to Spring Framework

Sonatype says 91 Spring vulnerabilities affecting more than 209,000 software components highlight how AI is accelerating vulnerability discovery and creating a new patching challen…

3 min

Aug24

Why “Tokenmaxxing” Was Always the Wrong Way for Developers to Measure AI Productivity

The term “tokenmaxxing” left the developer lexicon just as quickly as it arrived, and like most viral technology concepts, it means different things depending on who’s using it. In…

3 min

Aug19

Blogs

Are LLMs Equally Good (or Bad) at Building Secure Software?

An SCW study finds a large variance in how frontier and budget LLMs perform across different frameworks, and explains the striking cost variance.

3 min

Aug18

Blogs

Cloudsmith Extends Policies and Controls to Secure Application Binaries

Cloudsmith this week revealed it has expanded the policy management and continuous risk detection capabilities it makes available within its software artifact management platform t…

3 min

Aug13

Blogs

Production-Safe Testing: The Missing Piece in Most DevSecOps Strategies

Most DevSecOps teams invest heavily in security before deployment, yet attackers target the production environment where applications, APIs, and user behavior are constantly changi…

3 min

Aug12

Blogs

Why CI/CD Security Testing Is Going Autonomous (and Why It Should Stay Local)

Continuous integration and delivery changed the tempo of software. Teams merge dozens of times a day, infrastructure is redefined on every commit, and a new build can reach product…

3 min