Tag: devsecops
AWS Extends DevSecOps Reach to AI Coding Tools from Anthropic and OpenAI
Amazon Web Services (AWS) this week at the Black Hat USA conference revealed it is working with both Anthropic and OpenAI to integrate their respective coding tools with a service it has ...
RapidFort Extends Open Source Software Security Reach to Runtime Environments
RapidFort today at the Black Hat USA conference announced it has extended its ability to secure open source software to the runtimes that DevOps teams deploy in production environments. Michael Wood, chief ...
From API Integration to Agent Governance: What Backend Teams Need to Know About MCP
Many MCP projects begin with an existing API and a simple request: expose one backend capability to an LLM client. The quickest route is to wrap an endpoint as a tool and ...
Common Risks of Outsourcing Software Development, and How to Tackle Them
Roman Davydov | | Cybersecurity, devsecops, project management, software development, software development outsourcing, Third-Party RiskBoth SMBs and large enterprises often choose software development outsourcing over developing software in-house. It is no surprise, as partnering with external developers enables companies to bridge IT talent gaps that cannot ...
DevOps Is Drowning in Updates—and Engineering Is Paying the Price
Alex Vakulov | | cloud operations, devops, devsecops, information overload, platform engineering, site reliability engineeringDevOps used to be a manageable rhythm: several core tools, a handful of respected blogs, and a few incident write-ups that made everyone slightly uncomfortable in a useful way. Now it feels ...
Black Duck Extends Scope and Reach of Code Scanning Tool
Black Duck has updated its Coverity static analysis code scanning tool to provide deeper integrations with artificial intelligence (AI) tools along with updates to its user interface that make it simpler to ...
Zero Trust Starts at the Code: Building Secure Systems with PKI and DevOps Automation
BALA CHANDAR NAGALLA | | certificate lifecycle management, CI/CD security, devsecops, PKI, Software Supply Chain, zero-trustWhen a certificate expires, it can take down a production system, and teams usually only find out after something goes wrong. These issues are hard to catch because they rarely trigger alerts ...
AI Moved the Bottleneck From Writing Code to Understanding and Trusting It
Ted Julian | | AI code generation, AI code security, AI coding tools, AI investment ROI, AI-generated code, application security, automated code review, code quality, code review, codebase visibility, compliance, dependency risk, developer productivity, devsecops, Engineering leadership, engineering metrics, engineering ROI, production incidents, pull request review, SCA, software composition analysis, software delivery, software development productivity, software governance, technical debtAI coding boosts velocity, but without stronger review, governance and codebase visibility, teams risk higher costs, security gaps and production failures. TL;DR ...
Why Developer Workstations Have Become a Critical Part of the Software Supply Chain
Samuel Ogbonna | | CI/CD security, Developer Security, Developer Workstations, devsecops, open source security, Software Supply ChainFor years, software supply-chain security discussions focused on centralized infrastructure such as build servers, package registries, and CI/CD systems. Recent attacks suggest that this view is incomplete. The Megalodon campaign injected malicious ...
How to Build a DevSecOps CI/CD Pipeline on Azure With GitHub Actions
Fix security problems when they’re cheap to fix, which is before the code is deployed. A pipeline that enforces this automatically is what makes that principle real ...
North Korea Expands the Reach of PolinRider Supply Chain Attack Campaign
Jeff Burt | | AI supply chain attacks, APT37, Chrome Store, Contagious Interview, devops, devsecops, Famous Chollima, Go modules, Lazarus Group, malicious npm packages, North Korea, package registry malware, Packagist, PolinRider, Rescana, Socket, supply chainThe North Korean-sponsored threat groups behind the long-running fake interview scams targeting developers are expanding the PolinRider supply chain campaign that has escalated over the past several months. Reports from cybersecurity vendors ...
How AI is Revamping DevSecOps Processes
Umashankar Kotturu | | AI DevSecOps, CI/CD, devsecops, policy as code, security automation, Software Supply ChainArtificial Intelligence is pushing DevSecOps into a new phase where security is no longer just about detecting vulnerabilities, but increasingly about resolving them automatically within the flow of software delivery. As many ...
