Tag: provenance attestation
Why Your CI/CD Pipeline Is Your Most Unprotected Attack Surface
Muhammad Yawar Malik | | application security, build agents, build pipelines, CI/CD security, Cloud Security, credential security, dependency security, deployment security, devops security, devsecops, ephemeral runners, GitHub Actions, infrastructure security, Jenkins security, least-privilege, pipeline security, provenance attestation, secrets management, secure pipelines, secure software development, software provenance, Software Supply Chain, supply chain attacks, third-party actions, XZ UtilsCI/CD pipelines often hold privileged credentials, execute third-party code and connect directly to production, making pipeline security one of the most overlooked risks in modern DevOps ...
The Agent Proposes, the Pipeline Disposes: Controls for AI-Authored Change
Veera Ravindra Divi | | agent permissions, agentic coding, AI change control, AI code review, AI coding agents, AI Governance, AI pull requests, AI software development, AI-authored code, AI-generated code security, autonomous coding agents, bounded-write agents, change-budget gates, CI/CD security, human-in-the-loop, in-toto, independent evals, least-privilege, policy as code, protected paths, provenance attestation, provenance verification, Secure DevOps, signed attestations, Sigstore, SLSA, Software Supply Chain Security, staged autonomyWhen agents write code and open pull requests faster than humans can read them, ‘the diff looked fine’ stops being a control. The durable controls live outside the agent’s reasoning loop ...
Establishing Visibility and Governance for Your Software Supply Chain
Parth Patel | | application security, asset visibility, attack surface management, build-time security, Cloud Governance, context-aware security, cybersecurity governance, dependency tracking, eBPF runtime analysis, Kubernetes Gatekeeper, Log4Shell, open source security, provenance attestation, risk reduction, SBoM, SBOM automation, secure software development, SLSA, software bill of materials, software provenance, Software Supply Chain Security, supply chain risk, Third-party Dependencies, VEX, vulnerability management, vulnerability prioritizationAsset visibility and cloud governance start with SBOMs, VEX, and provenance tracking. Learn how to secure your software supply chain ...
