Minimus Adds VEX Support to Managed Hardened Images Service
Minimus has extended its managed service for providing application developers with hardened images to include support for the Vulnerability Exploittability eXchange (VEX) format used to share data across multiple application security tools and platforms along with hardened Helm charts for securely deploying applications on Kubernetes clusters. Additionally, Minimus has added compliance dashboards and views, and […]
Survey Surfaces Multiple Persistent DevSecOps Challenges
A survey of leaders based in North America finds 62% work for organizations that knowingly release insecure code to meet delivery deadlines.
The Hidden Imperative in the UK’s Software Security Code: Provable Readiness
The challenge ahead is clear: Let’s not settle for minimum viable security. Let’s aim for resilient, trustworthy and demonstrably secure software that stands up to the threats of today and tomorrow.
Report: Bulk of Application Vulnerabilities Don’t Require Immediate Attention
An analysis of more than 101 million application security alerts conducted by OX Security, a provider of an application security posture management (ASPM) platform, finds only 2% to 5% require immediate action, with more than 95% considered informational.
How to Extend an Application Security Program to AI/ML Applications
While various AI/ML application risks are like traditional application security risks and can be protected using the same tools and platforms, runtime security for the new models requires new methods of securing the applications.
Opus Security Platform Assigns DevSecOps Tasks to AI Agents
Opus Security today unveiled a platform that employs artificial intelligence (AI) agents to its vulnerability management platform that are trained to discover known issues and suggest remediations.
F5 Unveils Application Delivery and Security Platform to Address AI Infrastructure Challenges
F5 launches industry’s first converged Application Delivery and Security Platform, empowering DevOps teams to manage hybrid multicloud and AI-driven workloads more efficiently.
Five Key Steps for Turning Developers into Appsec Champions
Today’s fast-paced software development landscape can often create friction between development teams and their application security (AppSec) counterparts. While everyone wants to create a safe and successful product, their approaches differ, and developers are pressured to deliver features quickly, while security teams are measured on their ability to minimize risk. No company can afford development […]
DryRun Security Defines Application Security Policies Using Natural Language
DryRun Security today added an ability to use natural language to define and enforce application security policies as application developers build software.
DefectDojo Adds Ability to Normalize DevSecOps Data to ASPM Platform
DefectDojo today added a universal parser to its application security posture management platform (ASPM) that makes it possible to normalize data ingested from any DevSecOps tools and platforms that expose data in a JSON or XML format.
Linux Foundation Report Spotlights Open Source Software Package Challenges
The Linux Foundation in collaboration with multiple providers of software composition analysis (SCA) published a study this week, that in addition to identifying the most widely used software packages, also shined a light on fundamental challenges the open source community needs to address.
How an Effective AppSec Program Shifts Your Teams From Fixing to Building
Development teams are under growing pressure to build cutting-edge applications with shorter development lifecycles. However, they are often slowed down by the growing burden of fixing security vulnerabilities. Ineffective application security processes mean these teams can spend more time firefighting than building, diverting focus from their primary objective: Delivering innovative, high-performance software. Yet, healthy security […]
Microsoft Enlists Endor Labs to Integrate SCA Tool with CNAPP
Microsoft has tapped Endor Labs to incorporate a software composition analysis (SCA) tool into its cloud-native application protection platform (CNAPP).
AI Will Soon Automate DevSecOps Governance
The role cybersecurity teams play in ensuring applications are secure is about to become a lot more proactive in the age of artificial intelligence (AI).
Sonatype Report Surfaces Software Supply Chain Security Challenges
Sonatype today during a virtual All-Day DevOps (ADD) event shared the results of a report that finds there has been a 156% increase in the number of malicious open source packages year-over-year, reaching more than 512,847 for a 156% increase in the past year.
Legit Security Adds Application Security Rating Scorecards to ASPM Platform
Legit Security today added an ability to rate the level of software security that has been attained to its application security posture management (ASPM) platform.
Elevating DevOps Security: Why Integrating Threat Modeling Transforms Pentesting
Do not stop at compliance — embrace threat-driven pentesting and build a security posture that is ready for the real-world threats your organization faces.
SBOM as a Cornerstone of Secure Software Development
By providing transparency into the software supply chain, an SBOM helps organizations identify and manage vulnerabilities in third-party and open-source components.
AppSec Teams, DevOps Teams Facing Security Strain
https://devops.com/appsec-in-the-cloud-what-devops-teams-should-know/
Backslash Security Adds Simulation and Generative AI Tools to DevSecOps Platform
Backslash Security today added an ability to simulate upgrades to a higher version of an application to its application security platform for scanning code and creating software bills of materials (SBOMs).
Secure Code Warrior Unveils Agent to Manage Commit Permissions
Secure Code Warrior (SCW) today added an agent to its portfolio of application security that assesses the security competency of developers as they commit code to a repository.
Survey Surfaces Lots of Software Supply Chain Insecurity
A global survey of 900 application security professionals finds nearly two-thirds work for organizations that have had their software supply chains compromised in the past two years.
Ensuring Application Security from Design to Operation with DevSecOps
Safe development is critical for any company that creates software, whether for its own use or for others. DevSecOps principles focus on automating information security processes and introducing security measures early in software development. DevSecOps is extremely important these days as, according to recent surveys, more than 99% of tech professionals report that, on average, […]