AI coding agents: A call to action on dependency cooldowns
Delaying software upgrades creates a buffer against poisoned packages, but transitive dependencies continue to be a problem.
AppSec & Supply Chain Security
AI coding agents: A call to action on dependency cooldowns
Akrites marshals the open source community to counter AI threats
Industry heavyweights bring new focus to vulnerabilities in the age of AI. Here’s how it might help improve security.
New OWASP tool structures AI threat modeling
Threat Advisor could help teams with AI-specific risks. But a broader AppSec strategy rethink is needed in the AI era.
AI-BOM push borrows from the SBOM playbook
The Institute for Security and Technology's 'Driving AI Transparency' policy paper makes the case for AI-BOM minimum requirements.
2026 Gartner® Magic Quadrant™ for Software Supply Chain Security: 5 takeaways
The Magic Quadrant™ for Software Supply Chain Security is a 45-minute read. Here's what we feel security leaders need to pull from it.
Should frontier AI firms fund OSS ecosystem security?
With a ‘vulnpocalypse’ expected, AppSec leaders are calling for the companies to invest in a Great Refactor Fund to secure open source.
Agentic AI risk isn't a model problem. It's an architecture problem.
Agentic AI is moving the perimeter from components to data — and most strategies aren't built for that.
The race to secure AI coding: 4 steps to rein agents in
Coding agents are privileged insiders — with keys to CI/CD pipelines even as they give rise to ‘slopsquatting.’ Here’s how to govern them.
Update to npm blocks install scripts: What it means for AppSec
Disabling scripts by default closes the vector worms like Shai-Hulud rely on. Here's what the update fixes — and what it doesn't.
MCP security tracks API's playbook — we know how that ends
The standard connecting AI agents to tools and data leaves security to others. Make it a do-over.
Dependency remediation bolstered with CVE Lite CLI
OWASP's new dependency scanner gives developers actionable fixes. But supply chain attacks aren’t yet CVEs.
Get ahead of frontier AI: 5 AppSec strategy upgrades
Frontier AI is collapsing the time from vulnerability discovery to exploit. Here are 5 ways to update your AppSec before it hits.
CVE noise drowns out supply chain threats
48,000 CVEs were reported in 2025 — but just 58 were critical. A new report highlights why signal-to-noise ratio matters for AppSec.
5 lessons from vulnerability management's front lines
VM success is determined by findings reaching developers with context — which is getting more challenging. Here's why to shift gears.
Dependency attack takes down ed-tech platform at scale
The Canvas LMS supply chain compromise — which hit during finals week — shows the impact of cascading attacks.