Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The latest News and Information on Application Security including monitoring, testing, and open source.

Why You Can't "SAST" Your Way Through AI Security #AppSec #LLMs #CloudSecurity #Cybersecurity

AI apps break the traditional rules of application security. Here’s why: AI is cloud-native from day one. That means you’ve got runtime risk before your app even launches. Static analysis (SAST) doesn’t cut it. You can’t predict risk from just looking at code. AI models are just vectors. You need new methods.

Ethical Hackers & Bug Bounty: Our Security Journey #applicationsecurity #cybersecurity

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.

Unlocking Security: Why Bug Bounty Programs Are a MUST-HAVE #bugbounty #cybersecurity

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.

Hackers REVEALED: The TRUTH About Bug Bounty Programs #cybersecurity #bugbounty

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.

5 SAST Purchasing Tips That Actually Maximize ROI

Following these 5 tips when purchasing a SAST tool will save you headaches and regrets. A flashy demo or “industry-leading” badge doesn’t mean much if the tool doesn’t work for your code, your developers, or your workflow. This short video covers 5 things every AppSec or engineering team should consider before signing on the dotted line. Because choosing the wrong tool won’t just cost you budget, it’ll cost you trust.

Is Your Code Safe? Hidden Risks & Security Measures | Mend.io #cybersecurity #softwaresecurity

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.

You're Invited: Delivering malware via Google Calendar invites and PUAs

On March 19th, 2025, we discovered a package called os-info-checker-es6 and were taken aback. We could tell it was not doing what it said on the tin. But what's the deal? We decided to investigate the matter and initially hit some dead ends. But patience pays off, and we eventually got most of the answers we sought. We also learned about Unicode PUAs (No, not pick-up artists). It was a roller coaster ride of emotions!