AI agents are catching up quickly – even quicker than the security models that organizations constructed to enable the usage of humans. And the cracks are showing. Ask any security team operating an agentic workflow, and the story will be…
Most enterprise security programs are running a silent crisis under the radar. This isn’t about firewalls and phishing. It is about identity, that is, thousands of non-human identities (NHIs) that are running silently in cloud environments, SaaS architectures, CI/CD pipelines,…
In the recent past, identity security meant a strong employee password and IT’s ability to deprovision an account once the person left the firm. Clean, simple, human-shaped. The model has now failed – and the failure has occurred more quickly…
Generative AI has impacted multiple sectors – from health care diagnostics to fintech risk modeling, from automated content pipelines to AI copilots. With the advent of generative AI, businesses are looking for credible generative AI consulting partners that they can…
Open-source software silently rules the world. It runs banking applications, hospital systems, cloud infrastructure, and the tools developers use day-to-day. However, the greater the dependence we have on it, the more vulnerable we are likely to be- and OSS governance…
Most businesses have a firewall. Most have endpoint protection. However, ask them what security their top 20 vendors actually operate on, and the room goes silent. That is what is wrong with third-party vendor risk assessment and management presently. It’s…
Shipping software used to involve coding, building the code, and taking it live. Security discussions mostly ended with encrypting it in transit. Then SolarWinds happened. Then Codecov. Then a product of supply-chain break-ins came and wrote the new rules unobtrusively.…
Most developers know their code. Fewer understand what their code relies on – and such a gap is where modern precarities abide. One out-of-date library three levels deep in a dependency tree can compromise an entire production system, and traditional…
Most engineering teams use GitHub more like a file cabinet, with well-organized contents, instantiating code, setting up a pipeline, and leaving the settings page mostly untouched. This approach made sense when GitHub was only version control. Now, GitHub is in…
Have you forgotten how you can ship code without documenting all the components within it? Those days are gone. I began to take an interest in Software Bill of Materials (SBOM) after completing a project that was flagged as using…
In December 2020, during the SolarWinds breach, I remember thinking it was another advanced hack. However, after reviewing the technical report and observing the way offenders changed the playbook in the following five years, it became obvious: SolarWinds was not…
I understand, of course, that when you hear the term software supply chain security, you think it is another buzzword from salespeople. However, since SolarWinds made it apparent that a single breach of a build system can cost corporations and…