Tag

SBoM

54 articles

Latest in SBoM

Blogs

Why AI Agents Shouldn’t Guess at Vulnerability Exploitability

Vulnerability prioritization is not a language problem. The safest agent architectures use models to interpret and explain, while deterministic systems traverse the evidence. Ask a security team a simple question: Of the vulnerabi…

Sep 10, 20263 min

All SBoM Articles

Showing 1–24 of 54

Aug31

Broadcom Launches Trusted Artifact Service for Spring Framework

Broadcom launches TrueSource Trusted Artifacts to provide hardened Spring dependencies, secure open source packages and automated vulnerability remediation.

3 min

May11

Blogs

How Open Source Dependency and Repo Attacks Compromise DevOps Pipelines and How to Stay Safe

Modern applications rely on open source components for up to 90% of their code, creating a vast attack surface dominated by inhemalicious supply chain injections. High-profile inci…

3 min

Mar13

The Risk Profile of AI-Driven Development

Analysis arguing that AI-driven code generation accelerates dependency decisions and expands supply-chain risk, requiring shift-left governance, prompt-level controls, automated SB…

3 min

Jan28

Contributed Content

Software Supply Chain Threats Are on the OWASP Top Ten—Yet Nothing Will Change Unless We Do

Software supply chain security is steadily moving to the forefront of cybersecurity conversations. In the past, it has been overshadowed by a focus on malware outbreaks, ransomware…

3 min

Jan26

Codenotary’s Free SBOM Service Tackles the AI Software Supply Chain

Just because AI is writing your code doesn’t mean you can stop worrying about software bills of materials. While the quality of AI coding remains open to debate, there’s no questio…

3 min

Dec19

Surprise! Everybody Uses AI Tools for Software Development, Few Do So Securely

AI is generating code faster than teams can secure it, widening software supply chain risk and exposing major gaps in AppSec and governance.

3 min

Nov26

Blogs

What I’m Thankful for in DevOps This Year: Living Through Interesting Times

Alan reflects on a chaotic yet inspiring year in DevOps, highlighting the rise of AI in engineering, the maturation of DevSecOps, the evolution of hybrid work culture, the surge of…

3 min

Nov25

Contributed Content

What Fuels AI Code Risks and How DevSecOps Can Secure Pipelines

Modern development teams are under constant pressure to deliver fast, innovate continuously, and stay clear of security threats; all at the same time. Every new feature, every acce…

3 min

Nov03

Blogs

Cybersecurity Laws Will Shape the Future of DevOps

From the EU’s NIS2 Directive to U.S. SEC breach disclosure rules, cybersecurity regulation is accelerating faster than code releases. DevOps teams must evolve into RegOps—embedding…

3 min

Oct29

Blogs

AppOmni Open Sources Heisenberg Tool to Scan Pull Requests for Dependencies

AppOmni has made available an open source tool that automatically scans pull requests (PRs) to flag risky or newly published dependencies before they are merged. Dubbed Heisenberg,…

3 min

Oct27

Blogs

Patch Management is Essential for Securing DevOps

Zero-day exploits don’t wait for anyone and are one of the main reasons why the cybersecurity market will be worth a whopping $256 billion worldwide. In the current threat landscap…

3 min

Oct21

Cycode Previews Ability to Identify AI Tools and Platforms Used to Write Code

Cycode today announced it is providing early access to a capability that identifies which artificial intelligence (AI) coding tools are being employed by application developers in…

3 min

Oct14

Blogs

Establishing Visibility and Governance for Your Software Supply Chain

Asset visibility and cloud governance start with SBOMs, VEX, and provenance tracking. Learn how to secure your software supply chain.

3 min

Oct01

Blogs

Worms in the Supply Chain: Shai-Hulud and the Next DevOps Reckoning

DevOps was supposed to make software delivery faster, safer and more reliable. For the most part, it has. But every so often, something nasty crawls out of the shadows and reminds…

3 min

Jul11

Blogs

SBOMs Are Not Enough

Track your components, patch when needed and you’ve got your risk covered. But that’s only part of the story.

3 min

Jun04

Blogs

Survey Surfaces Uneven Adoption of SBOMs to Secure Software

A survey of 100 security professionals finds nearly half (48%) of security professionals admit their organizations are falling behind on meeting software bill material (SBOM) requi…

3 min

Feb26

Blogs

Legit Security Extends ASPM Platform to Provide More Vulnerability Context

Legit Security this week added an ability to determine the level of risk a vulnerability actually represents to its application security posture management (ASPM) platform.

3 min

Jan28

Endor Labs Adds Ability to Identify Open Source AI Models to SCA Tool

Endor Labs today added an ability to detect open-source artificial intelligence (AI) models downloaded from the Hugging Face repository that have been incorporated into source code…

3 min

Dec19

Application Performance Management/Monitoring

RunSafe Security Extends Platform Reach to Build More Accurate SBOMs

RunSafe Security this week added an ability to generate a software bill of materials (SBOM) based on the code actually included in an application before it is deployed in a product…

3 min

Jun14

Mend.io Adds Tool to Detect Presence of Generative AI Code

Mend.io this week added a MendAI tool to its application security portfolio that identifies code generated by an artificial intelligence (AI) model.

3 min

May30

Lineaje Adds Module to Manage Open Source Software Security Lifecycle

This can help DevSecOps teams identify open source software projects that are not being well maintained.

3 min

Mar20

Blogs

The IT-DevOps Life Cycle is Like a Pyramid That Keeps Growing

For the most part, the demand for new technology to solve age-old problems has been a net increase in workload.

3 min

Nov22

Application Performance Management/Monitoring

Lineaje Allies With Persistent Systems on Open Source Software Remediation Service

Lineaje and Persistent Systems are providing a managed service for remediating open source vulnerabilities that leverages AI technologies.

3 min