Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The latest News and Information on Application Security including monitoring, testing, and open source.

Bridging ASPM and Vulnerability Management for Scalable Application Security

In this webinar, "Bridging ASPM and RBVM for Scalable AppSec," security leaders from Cycode and Nucleus explore how to unify application and infrastructure vulnerability management in complex, cloud-native environments.

Container Security is Hard - Aikido Container Autofix to Make it Easy

Container security starts with your base image. But here’s the catch: In this post, we’ll explore why updating base images is harder than it seems, walk through real examples, and show how you can automate safe, intelligent upgrades without breaking your app.

Leveling Up AppSec: Overcome Vulnerability Management Challenges in Game Development

Game development studios face enormous pressure to deliver immersive, high-performance experiences on a rigid schedule, all while ensuring that every release meets the highest standards for quality and security. For security teams, keeping up with fast-moving codebases, short release cycles, and a flood of vulnerabilities is no easy feat.

Embeddings vs. Generative Models #AI #RAG #AIExplained #MachineLearning #OpenAI #LLMs #AIsecurity

Not all AI models are made to generate. Some are built to understand. Here’s the key difference: Generative models take in text and produce new text (think ChatGPT). Embedding models take in text and translate it into numbers, vectors that capture meaning. Why does that matter? Because embedding models let you turn documents into searchable vectors. That means when someone asks a question, you don’t need to search the whole doc, you just find the most relevant chunks based on meaning. And that’s what makes things like RAG (Retrieval-Augmented Generation) powerful and efficient.

SOC: Does Your Company Need One? (Budget vs. Protection) #soc #cybersecurity

At what point should a company invest in a Security Operations Center (SOC)? Learn when businesses should start thinking seriously about building cybersecurity defenses—and why protecting revenue is just as critical as generating it. Many companies wait too long to prioritize cybersecurity. Discover why having a SOC isn't just for giant enterprises—and why protecting your revenue must be part of your business growth strategy from the start.

SolarWinds Hack: How State Actors Infiltrated & What You Can Learn #cybersecurity #solarwinds

State actors played the long game by targeting SolarWinds’ build server, injecting malicious code without detection. Learn why code diffs, hash checks, and decompiling builds are critical for cybersecurity today.

Build Trust Now: Transparent Dialogue for a Trustworthy Organization #trust #cybersecurity

Building trust shouldn't start when there's already a problem. Learn how to proactively create transparent, trust-first conversations with customers—and why trust must be engineered into your security programs from the start. Building trust isn't reactive—it’s proactive. Discover how to open transparent conversations before issues arise, why trust must be built into every layer of your security program, and how to communicate that trust effectively during the sales process.

RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)

On 5 May, 16:00 GMT+0, our automated malware analysis pipeline detected a suspicious package released, rand-user-agent@1.0.110. It detected unusual code in the package, and it wasn’t wrong. It detected signs of a supply chain attack against this legitimate package, which has about ~45.000 weekly downloads.

Dynamic Application Security Testing: DAST Basics

DAST is a security tool that attempts to penetrate an application from the outside by checking its exposed interfaces for vulnerabilities and flaws. Sometimes called a web application vulnerability scanner, it is a type of black-box security test. It looks for security vulnerabilities by simulating external attacks on an application while the application is running.

7 Core Principles of an Effective Application Security Program

If you’re building software, chances are your environment looks nothing like it did a few years ago. Monolithic applications have given way to microservices. On-prem systems have migrated to multi-cloud. Waterfall has become agile, and developers are pushing code daily (sometimes hourly). Security, meanwhile, is still catching up.