The DevOps Bottleneck: Why IaC Orchestration is the Missing Piece
If you work in DevOps, you’ve heard it a thousand times: “Do more with less.” More automation, more security, more reliability—but with the same (or fewer) people. Meanwhile, your development teams keep growing, pushing out new features at breakneck speed. Yet somehow, the infrastructure team is supposed to scale magically to keep up. Let’s be […]
JFrog Survey Surfaces Limited DevSecOps Gains
A global survey of 1,402 application developers, cybersecurity and IT operations professionals finds 71% work for organizations that, despite any potential vulnerabilities, still allow developers to download packages directly from the internet.
Microsoft’s Hyperlight Wasm: Bringing WebAssembly to Secure Micro-VMs
Microsoft expands its Hyperlight project with Hyperlight Wasm, enabling secure WebAssembly workloads in lightweight VMs across Windows, Linux, and macOS platforms.
Sonar Combines SAST and SCA Tools in Single Offer
Sonar today revealed it will at the end of May add an offering that combines its Static Application Security Testing (SAST) tool with the software composition analysis (SCA) tools it gained with the acquisition of Tidelift late last year.
OpenSSF Defines Baseline for Securing Open Source Software
The Open Source Security Foundation (OpenSSF) has launched an initiative to provide maintainers of open source software projects with a set of baseline security requirements that can be realistically attained and maintained by small teams.
7 Critical API Protection Strategies to Fortify Your API Security
Against a backdrop of escalating threats and costly consequences, organizations need a comprehensive, multilayered approach to API security.
Endor Labs Extends Microsoft SCA Alliance to GitHub
Endor Labs has allied with GitHub to integrate its software composition analysis (SCA) tools directly within DevOps workflows.
Open Source Software Security Concerns with Spike Curtis
Spike Curtis, principal engineer for Coder Technologies, dives into why open source software security concerns are valid, and why the only viable option is to invest more in securing software supply chains to mitigate potential threats. While open source benefits from community oversight, organizations must vet the projects they rely on to avoid security gaps. […]
Life After Death, HeroDevs Acquires Xeol To Remediate Unsupported Software Zombies
Xeol tracks end-of-life data in 100,000+ open-source software packages to help identify and remediate unsupported software in one streamlined workflow.
How to Prove That Your Security-Aware Developers are a Cut Above the Rest
Security-aware developers are the best first line of defense an organization can have when it comes to software security.
The State of Application Risk: Key Findings Reveal Widespread Security Vulnerabilities
New research reveals that 100% of organizations face critical app security risks. Learn key findings and essential steps to protect your software development pipeline.
Navigating the Next Wave of Cybersecurity Legislation With a Supercharged Security Culture
CISOs at the forefront of implementing developer-driven security programs choose upskilling solutions that allow for precision measurement, in addition to customization that is reflective of scenarios they are most likely to encounter in the course of their work.
Evolving Shift Left Security: A More Powerful Approach to Software Development Security
For several years, teams have been empowered to shift security left, embedding it earlier in the development process.
Five Trends That Will Drive Software Development in 2025
In 2025, developers will broaden the scope of how they use AI with promising new applications for reducing technical debt and improving security.
Software Dev Culture Shock: “I Have to Do WHAT Now!?”
Software bills of materials (SBOMs) have sparked a real culture shock in developer teams that are being made to account for – and be scrutinized over – the minute decisions they make in the development of software.
Best of 2024: Securing the DevOps Pipeline: Tools and Best Practices
Because of the critical nature of the DevOps pipeline, security is becoming a top priority. Here’s how to integrate DevSecOps.
The Day a Software Update Broke Corporate America
For organizations prioritizing resilience, adopting infrastructure-agnostic solutions that enable seamless workload management across platforms should be at the top of the list.
Microsoft Enlists Endor Labs to Integrate SCA Tool with CNAPP
Microsoft has tapped Endor Labs to incorporate a software composition analysis (SCA) tool into its cloud-native application protection platform (CNAPP).
Security Concerns Loom as GenAI Adoption Grows in DevOps
Most security and software development professionals are using GenAI-based solutions for building or delivering applications, but despite its widespread use, significant security challenges persist.
Symbiotic Security Platform Discovers Security Vulnerabilities as Developers Write Code
Symbiotic Security emerged from stealth this week to launch a namesake platform that enables application developers to discover and remediate vulnerabilities and other errors in real-time as code is being written.
Four Steps to Balance Agility and Security in DevSecOps
Balancing agility and security in DevSecOps is achievable with the right mix of automation, collaboration and continuous feedback. By embedding security into agile processes, organizations can deliver software that is both fast and secure, meeting the demands of today’s fast-paced tech environment.
6 Essential Components of a Successful Security ‘Rewards Program’ for Software Developers
The software development industry could use a rewards program especially when it comes to ensuring a ‘security first’ mindset among developers.
GitHub Steers Copilot Autofix Into Eye of AI Security Storm
GitHub has come forward with its new Copilot Autofix tool. This AI-driven software service is targeted at developers who need to address software vulnerabilities in code destined for traditional applications and inside those infused with an injection of new or existing breeds of AI.