Tag: policy as code
AI Agents Are Writing Your Infrastructure Code. Is Anyone Governing It?
Neel Shah | | agentic infrastructure, AI agent governance, AI coding assistants, AI-generated infrastructure, cloud misconfiguration, cloud security automation, continuous drift detection, devops security, IAM misconfiguration, infrastructure as code security, infrastructure compliance, infrastructure guardrails, Kubernetes security, platform engineering security, policy as code, RBAC for AI agents, secure-by-default platforms, SRE governance, StackGen Aiden, Terraform securityAI agents now generate infrastructure code at scale, but security pass rates are stuck at 55%. Here’s how teams can close the governance gap ...
Signed, Attested, and Malicious: The Software Supply Chain Has a Deepfake Problem
Nigel Douglas | | AI coding agents, AntV packages, behavioural analysis, continuous scanning, dependency security, Developer Security, GitHub Actions compromise, malicious packages, Miasma worm, Mini Shai-Hulud, npm malware, OIDC tokens, open source security, package provenance, package quarantine, policy as code, Red Hat npm attack, registry scanning, Shai-Hulud worm, SLSA provenance, software attestation, Software Supply Chain Security, TanStack compromise, trusted pipeline attacksA developer pulls a package from a reliable repo. It is signed, has provenance, and has been scanned. And then…it contains malware. That is no longer hypothetical. When the Miasma worm tore ...
HashiCorp Introduces tfpolicy, a Native Policy Framework for Terraform
Tom Smith | | Cloud Security, compliance automation, Hashicorp, HCL, HCP Terraform, infrastructure as code, Infrastructure Governance, OPA, Open Policy Agent, platform engineering, policy as code, Sentinel, Terraform, tfpolicyHashiCorp’s new tfpolicy framework brings native policy-as-code governance to Terraform using HCL and lifecycle-aware infrastructure checks ...
How AI is Revamping DevSecOps Processes
Umashankar Kotturu | | AI DevSecOps, CI/CD, devsecops, policy as code, security automation, Software Supply ChainArtificial Intelligence is pushing DevSecOps into a new phase where security is no longer just about detecting vulnerabilities, but increasingly about resolving them automatically within the flow of software delivery. As many ...
Risk-Based Review for Infrastructure as Code Pull Requests
Naga Krishna Reddy Muppidi | | automated review systems, blast radius analysis, change approval workflow, change management, CI/CD governance, cloud infrastructure, Cloud Security, deployment risk, deployment safety, devops, devsecops, Engineering Governance, engineering productivity, gitops, IaC review, infrastructure as code, infrastructure auditing, infrastructure automation, infrastructure change tracking, infrastructure compliance, infrastructure controls, infrastructure delivery, Infrastructure Governance, infrastructure observability, infrastructure reliability, infrastructure risk scoring, infrastructure security, operational risk management, platform engineering, platform operations, platform team workflows, policy as code, production changes, production deployments, pull request review, reviewer fatigue, reviewer workflows, risk assessment, risk-based review, security review automationNot every infrastructure pull request deserves the same review path. A tag change in a development account and a network-policy change in production should not create identical reviewer load. When every change ...
FinOps Isn’t Slowing You Down — It’s Fixing Your Pipeline
Tom Hollowell | | CI/CD, cloud cost optimization, Cloudability, devops, FinOps, IaC governance, Infrastructure Cost, policy as code, shift left, TerraformStop firefighting cloud costs weeks after deployment. Learn how to "shift cost left" by integrating cost estimates and policy-as-code directly into your DevOps workflows using tools like Terraform and GitHub ...
Security as Code is Becoming the New Baseline: Continuous Compliance in DevOps
Muhammad Yawar Malik | | admission control Kubernetes, automated audit logs, CIS benchmarks automation, Cloud-native governance, continuous compliance, devsecops automation, DORA compliance DevOps, EU Cyber Resilience Act security, infrastructure as code security, platform engineering security, policy as code, Rego policy enforcement, Security as Code 2026, security feedback loops, SOC 2 continuous monitoringThere was a time when compliance meant a quarterly ritual. Someone from security would walk over with a spreadsheet, ask a few questions, tick a few boxes and disappear until the next audit cycle ...
Why Investing in DevOps Platforms Pays off for Businesses
Johnbosco Ejiofor | | cost of downtime 2026, Detutu Media DevOps, developer autonomy, DevOps platform market 2028, DevSecOps market valuation, DORA Report 2025 AI, GitOps reliability, golden paths DevOps, hybrid cloud adoption, IDP ROI, Internal Developer Platforms 2026, multi-cloud strategy 2024, Platform Engineering growth, platform governance cloud costs, policy as code, SBOM compliance, Segun Onibalusi, SLSA standards, trust paradox software, value stream managementExplore why 80% of organizations are adopting Internal Developer Platforms (IDPs) by 2026. From reducing setup time by 40% to mitigating $9,000-per-minute downtime costs, discover the undeniable ROI of platform engineering, "golden ...
Policy as Code for Cost Control, Not Just Compliance
Mariusz Michalowski | | cloud cost management, FinOps, infrastructure as code, kubernetes, platform engineering, policy as codePolicy as code can do more than enforce compliance. Learn how platform teams use guardrails, tagging and sizing policies to prevent cloud cost waste early ...
How OPA Changed Our Go-No-Go Forever
Learn how Open Policy Agent (OPA) transformed go/no-go releases from subjective meetings into automated, auditable, policy-driven decisions embedded directly in the CI/CD pipeline ...
GitOps Implementation at Enterprise Scale — Moving Beyond Traditional CI/CD
Sumanth Kadulla | | ArgoCD, change traceability, CI/CD migration, CI/CD reliability, cloud native delivery, configuration drift, declarative infrastructure, deployment automation, deployment rollback strategy, DevOps at scale, devsecops, dora metrics, gitops, GitOps adoption, GitOps security, infrastructure as code, Kubernetes continuous delivery, platform engineering, policy as code, pull-based deploymentsTraditional CI/CD pipelines hit scaling limits. Learn how GitOps improves deployment reliability, security, and DORA metrics—and what it takes to migrate successfully ...
What is OPA (Open Policy Agent)?
Open Policy Agent (OPA) is a versatile policy engine designed to handle policy enforcement across cloud infrastructures. It enables users to define and apply policies consistently across a variety of systems, helping ...
