Why AI coding makes zero trust an AppSec requirement
Traditional SBOMs, signing, and provenance all have blind spots, making them no longer capable of assuring software security.
Featured
Why AI coding makes zero trust an AppSec requirement
Can Lean improve security for AI-coded software?
AI coding requires the stack be reconstructed with mathematical proofs built in — a task well suited to the Lean language. Here’s the reality.
RL Malware Analysis and Threat Hunting Updates for H1 2026
Spectra Detect is now Kubernetes-native. Spectra Analyze adds AI workflows for the agentic SOC. Here's everything that shipped.
Latest
How to Leverage Spectra Analyze's Search for SVG Analysis
Here's how to use Spectra Analyze to hunt for malicious SVGs, from setting up queries and evaluations of samples to tips for investigation.
Why AI coding makes zero trust an AppSec requirement
Traditional SBOMs, signing, and provenance all have blind spots, making them no longer capable of assuring software security.
Can Lean improve security for AI-coded software?
AI coding requires the stack be reconstructed with mathematical proofs built in — a task well suited to the Lean language. Here’s the reality.
RL Malware Analysis and Threat Hunting Updates for H1 2026
Spectra Detect is now Kubernetes-native. Spectra Analyze adds AI workflows for the agentic SOC. Here's everything that shipped.
AI coding agents: A call to action on dependency cooldowns
Delaying software upgrades creates a buffer against poisoned packages, but transitive dependencies continue to be a problem.
Security teams ditch AI-only pen testing
A new report finds weakening trust in AI-only testing — and more willingness to keep humans in the loop. Here's why.
Akrites marshals the open source community to counter AI threats
Industry heavyweights bring new focus to vulnerabilities in the age of AI. Here’s how it might help improve security.
Hidden in plain sight: How SVGs carry malicious scripts
SVGs are difficult to detect, can be snuck into content — and can do malicious and legitimate actions. Here's how malicious SVGs work.
ClickFix doesn't attack your knowledge. It attacks your trust.
One of the most effective attack methods I've analyzed this year runs on legitimate tools and willing users — and AV and EDR is blind to it.
New OWASP tool structures AI threat modeling
Threat Advisor could help teams with AI-specific risks. But a broader AppSec strategy rethink is needed in the AI era.
The tale of ClickFix: 5 takeaways from RL’s new threat report
New RL research explains why ClickFix attacks are multiplying — and why reliable detection requires going beyond AV and EDR.
AI-BOM push borrows from the SBOM playbook
The Institute for Security and Technology's 'Driving AI Transparency' policy paper makes the case for AI-BOM minimum requirements.
Hunting Device Code Phishing Pages
RL recently discovered active Microsoft 365 device code phishing. Here's a walkthrough of how our researchers found the campaign.
‘Download pumping’ joins the trust-abuse bandwagon
While this repository vector is not new, researchers have uncovered a new twist for exploiting trusted metrics to hide malicious code.
This Report from Gartner Defines the Software Supply Chain Security Market
Explore the new Gartner® Magic Quadrant™ for software supply chain security and learn why ReversingLabs is recognized.