AI-BOM minimum elements proposal builds on SBOM lessons
The Institute for Security and Technology's 'Driving AI Transparency' policy paper makes the case for defining AI supply chain visibility.
Featured
AI-BOM minimum elements proposal builds on SBOM lessons
Spectra Analyze in Action: Hunting Device Code Phishing Pages
RL recently discovered active Microsoft 365 device code phishing. Here's a walkthrough of how our researchers found the campaign.
‘Download pumping’ joins the trust-abuse bandwagon
While this repository vector is not new, researchers have uncovered a new twist for exploiting trusted metrics to hide malicious code.
Latest
AI-BOM minimum elements proposal builds on SBOM lessons
The Institute for Security and Technology's 'Driving AI Transparency' policy paper makes the case for defining AI supply chain visibility.
Spectra Analyze in Action: Hunting Device Code Phishing Pages
RL recently discovered active Microsoft 365 device code phishing. Here's a walkthrough of how our researchers found the campaign.
‘Download pumping’ joins the trust-abuse bandwagon
While this repository vector is not new, researchers have uncovered a new twist for exploiting trusted metrics to hide malicious code.
This Report from Gartner Defines the Software Supply Chain Security Market
Explore the new Gartner® Magic Quadrant™ for software supply chain security and learn why ReversingLabs is recognized.
AI use in cybersecurity is on the rise — and so is burnout
The Life and Times of Cybersecurity Professionals study highlights a trend that has accelerated as cyber has become more complex.
2026 Gartner® Magic Quadrant™ for Software Supply Chain Security: 5 takeaways
The Magic Quadrant™ for Software Supply Chain Security is a 45-minute read. Here's what we feel security leaders need to pull from it.
Software Supply Chain Security Just Got Its Own Magic Quadrant — and RL Is In It
SSCS is a footnote that grew up, moved out, and got its own report.
Should frontier AI firms fund OSS ecosystem security?
With a ‘vulnpocalypse’ expected, AppSec leaders are calling for the companies to invest in a Great Refactor Fund to secure open source.
Can AI beat AI? 3 challenges with VulnOps adoption
SecOps leaders must tackle cost and risk to deliver autonomous vulnerability operations. But with frontier AI, it's critical.
Gartner® Named RL a Software Supply Chain Security Visionary. Here’s What We See Coming
The first Magic Quadrant™ for Software Supply Chain Security comes as, we feel, the demand for greater supply chain visibility explodes.
Agentic AI risk isn't a model problem. It's an architecture problem.
Agentic AI is moving the perimeter from components to data — and most strategies aren't built for that.
The race to secure AI coding: 4 steps to rein agents in
Coding agents are privileged insiders — with keys to CI/CD pipelines even as they give rise to ‘slopsquatting.’ Here’s how to govern them.
Update to npm blocks install scripts: What it means for AppSec
Disabling scripts by default closes the vector worms like Shai-Hulud rely on. Here's what the update fixes — and what it doesn't.
Device code phishing bypasses password stealing
The Microsoft 365 phishing campaign persuades victims to complete a real authentication process that authorizes an attacker-controlled device.
How to defend ARM64 cloud infrastructure from ITScape
RL has documented CVE-2026-46316, and developed two YARA rules to help detect exploits of the multi-tenant cloud vulnerability.