Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Security isn't a department.

Security isn’t a department. It’s a shared responsibility. To move from reactive to preventive, every product team needs embedded cyber expertise. Ange Ferrari, SVP and CISO at Metro AG, explains how decentralizing security enables scale and forces organizations to treat security as everyone's job, not just IT's. If you want to "shift left" for real, this episode is your playbook.

API Gateway Security: The Essential InfoSec Guide

As the software world shifted toward microservices and distributed architectures, the volume and complexity of API traffic have skyrocketed. Unfortunately, so has the number of API-related breaches and cyber attacks. Last year, nearly 44% of all advanced bot traffic online targeted API endpoints, while traditional web applications received just 10% of the malicious traffic. It’s no surprise that 57% of organizations admit to having suffered API-related breaches in the past two years.

Your Code Might Be Using Risky AI Models

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.

Catch Bugs Faster: Cursor's BugBot for AI Code Review

In this video we dive into Cursor's 1.0 release, focusing on their new BugBot feature. This AI-powered tool integrates with your GitHub workflow to automatically review pull requests and identify potential bugs. We'll show you how to set up BugBot, trigger it on a pull request, and analyze the issues it finds, including a real-world example of it catching errors in AI-generated code from Google's Jules tool.

The New Threat Landscape: AI-Native Apps and Agentic Workflows

Businesses are moving beyond AI experiments and proofs of concept. As we approach what IDC is predicting will be the “AI pivot years” of 2025-2026, organizations are prioritizing, planning, and building for scale. This shift includes AI agents — self-directed tools that automate tasks — as technology providers strive to simplify development workflows. Under the surface, AI systems expose an expanded threat landscape that spans the software development lifecycle (SDLC).

Why we moved our ECS services from Fargate to EC2

At Tines, we rely heavily on AWS Elastic Container Service (ECS) to power our workflow automation platform. For a couple of years, we used Fargate as our default compute layer – offering simplicity and removing the need to manage underlying hosts. However, as we scaled, we started hitting the edges of what Fargate could reliably offer. This is the story of why we migrated our backend services to an EC2-backed ECS Capacity Provider and what we learned along the way.

AWS KMS Embraces the Quantum Era with ML-DSA Digital Signature Support

As quantum computing creeps closer, the cryptographic mechanisms on which today’s digital world relies are becoming more and more fragile. In a prescient move, AWS Key Management Service (KMS) now supports ML-DSA, one of the first post-quantum digital signatures, which has become a standard under FIPS 203. This is an important step in AWS’s broader efforts to prepare customers for the post-quantum secure future.

2025 Gartner SRM Summit: From Gatekeeper to Enabler. How Security Leaders Can Embrace AI Agents with Confidence

The 2025 Gartner Security & Risk Management Summit was a wake-up call, and an opportunity, for anyone responsible for securing the future of AI. With over 1,700 AI use cases now reported across federal agencies and enterprise adoption growing at a breakneck pace, the message was clear: AI is no longer on the horizon. It’s here, it’s active, and it needs securing.