Software supply chain security requires decisions rather than defaults
Most software runs on decisions nobody made. We talk about why gating, pinning, backporting, and SBOM upkeep only work if someone actually owns them. Category: News
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,719 matching stories — announcement, in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Aikido Security achieves ISO 42001:2023 certification for AI governance
Aikido Security has achieved ISO 42001 certification, the global standard for AI governance, covering AI pentesting, Code Security Audit, and Deep PR Review. Category: Compliance
The Regulators Already Assume You Have an AI Inventory. Do You?
The regulators are done with “Trust as policy”.   That chain used to be an internal maturity problem, something a security program could work on over time:  A developer trusts AI-generated code because it compiles. A reviewer trusts an AI-generated summary because it reads plausibly. A security team trusts scanner output because the pipeline shows […]
Manifest Supplier Risk: See Vendor Risk Like Your Own Code
Manifest Supplier Risk gives security teams a live, supplier-centric view of vendor risk grounded in real SBOM data, replacing stale point-in-time questionnaires.
Why Your AI Application Is Exposed (Even When Your Scans Come Back Clean)
AI applications can pass security scans yet remain exploitable through chained attacks across models, tools, data, and business workflows. Learn how DAST, AI pentesting, and red teaming work together to expose end-to-end risk.
Multi-Cloud Security: Managing Risk Across Cloud Infrastructures
Discover why multi-cloud security is becoming essential and how continuous security monitoring helps organisations manage risk across multiple cloud environments. The post Multi-Cloud Security: Managing Risk Across Cloud Infrastructures first appeared on ArmourZero.
False Positive Elimination: How Runtime Context Saves Developer Time
TL;DR Traditional application security tools generate false-positive vulnerability findings because they analyze code patterns without execution context, flagging vulnerabilities in code that never runs with untrusted data. Runtime instrumentation solves this by observing actual production behavior, revealing that only a small percentage of flagged vulnerabilities are truly exploitable. Reducing application security false positives is a critical challenge for modern dev teams. By shifting from p
When Both of You Are Compromised: Coordination Beyond Your Own Walls
Cyber campaigns can compromise both a water utility and its partners. Learn why resilient coordination channels matter for mutual aid, reporting, and response.
Beyond the $1 AI era: How federal agencies can build the evidence for FY27 renewals
Learn how federal agencies can use Datadog Cloud Cost Management to build the cost, usage, and value evidence needed for FY27 AI renewals as OneGov promotions expire.
How Datadog saves over $1 million each month by optimizing AI usage
Learn how Datadog uses agent evaluations, spending guardrails, and context optimization to save over $1 million each month while balancing cost and performance.
8 Best API Security Testing Tools in 2026
Compare eight of the best API security testing tools in 2026, including StackHawk, ZAP, Burp Suite, and more. See how they compare on API coverage, authentication, CI/CD integration, pricing, and authorization testing. The post 8 Best API Security Testing Tools in 2026 appeared first on StackHawk, Inc..
SBOM's Moment of Validation at the UN's AI for Good Summit | CyBeats
SBOM found unexpected validation at the UN's AI for Good Summit. CyBeats advisor Duncan Sparrell on why the debate is over and what's next for AI supply chains.
From millions of log lines to actionable patterns in seconds with log pattern analysis
Logs provide the ground truth of what's happening across your systems — but finding meaningful signals in that data can feel like searching for a needle in a haystack. A single Kubernetes cluster can generate thousands of nearly identical log messages within minutes, originating from dozens of applications and services that often lack a consistent structure. The post From millions of log lines to actionable patterns in seconds with log pattern analysis appeared first on Dynatrace news.
Agentic AI Security in 2026: The Ultimate Guide
Security and engineering teams face a growing disconnect. Development moves at the speed of automated CI/CD pipelines. Security often moves at the speed of manual triage. Over the past few years, artificial intelligence promised to bridge this gap. Yet, for many enterprise application security teams, early AI adoption simply created more work.
Broken Access Control: Examples, Detection, and Prevention
Learn how broken access control vulnerabilities like IDOR and privilege escalation happen, how code review can detect them, and how runtime testing verifies authorization across users, roles, and resources. The post Broken Access Control: Examples, Detection, and Prevention appeared first on StackHawk, Inc..
Customer Zero: Implementing Package Firewall at Endor Labs | Blog | Endor Labs
Customer Zero: Implementing Package Firewall at Endor Labs
SRE best practices and platform engineering trends: How AI workloads raise demands on observability to meet reliability requirements
AI workloads are reshaping SRE and platform engineering. New Dynatrace research shows how AI is changing SRE and platform engineering in two ways: teams are using AI to streamline and scale IT and DevOps while taking on greater responsibility for the reliability, performance, and cost of AI workloads. The post SRE best practices and platform engineering trends: How AI workloads raise demands on observability to meet reliability requirements appeared first on Dynatrace news.
Coding Agents Just Reopened Your Software Supply Chain Blind Spot
Most organizations spent years hardening their software supply chain. The model is familiar: dependencies flow through a controlled repository, policies determine what is allowed, scanning catches what slips through, and every action is logged for auditability. It works because human developers operate within environments that enforce these rules. AI coding agents break that assumption entirely. …
How BADBOX-Linked Malware Turned Automotive Head Units into Proxy Nodes
VicOne shows how BADBOX-linked malware used DoFun Android head units, weak MQTT security, and trusted OTA updates to push silent, persistent installs.
Your Innovators Hub, Built Around You
Earlier this year, we introduced Ivanti Innovators Hub to bring together support, knowledge and community into a more unified experience. That launch established a strong foundation for a more effortless and predictable experience. Now, we're building on it with new enhancements designed to make the Hub more personalized, connected and relevant, with integrated learning opportunities, stronger community engagement and more tailored experiences. A more personalized experience Th
One SBOM, five auditors! How you can map software inventory to ISO 27001, SOC 2, PCI DSS 4.0.1, HIPAA, and NIST SSDF
The post One SBOM, five auditors! How you can map software inventory to ISO 27001, SOC 2, PCI DSS 4.0.1, HIPAA, and NIST SSDF appeared first on Anchore.Ask a compliance lead how many times she’s answered “what’s running in your software” this quarter. PCI wants it in one format. SOC 2 wants a different export. The ISO surveillance auditor wants a third version. NIST wants a fourth, for SSDF attestation. Same question, four spreadsheets, and at least one of them is already
Could OpenClaw have actually hacked that Australian gym? We decided to test it.
We recreated the viral AI gym hack in a controlled environment. Running Opus 4.6 on OpenClaw, the model exploited the booking flaw in nine of ten runs. Category: Research
Der Cyber Resilience Act in zwei Wochen: Was ist tatsächlich bereit, und was noch nicht?
Zwei Wochen vor dem Inkrafttreten der Meldepflicht gemäß Artikel 14 befindet sich die dahinterstehende Infrastruktur noch im Aufbau. Die Leitlinien der Kommission sind zwar genehmigt, aber noch nicht offiziell in Kraft getreten. Die Meldeplattform befindet sich in der Testphase und ist noch nicht live. Kein einziger harmonisierter Standard ist im Amtsblatt veröffentlicht. Jede dieser Lücken […]
The End-State Fallacy and How to Buy AI Security – Evaluation Guide
Even if AI security eventually favors defenders, the transition sharply favors attackers. The end-state fallacy is why, and it should change what you buy this year.
Why Financial Services Is the Canary in the Code Mine
Organizations have long known that attackers publish malicious packages to public open source registries. The more consequential question is if those packages are actually reaching enterprise development environments.
ClickFix Phishing Pages Discovered in 24 npm Packages
OX Security identified and is tracking a fake Cloudflare Captcha campaign that can potentially distribute ClickFix malware through npm, and found 24 distinct malicious packages sharing the exact same malicious code. Overview The OX Research team is tracking a fake Cloudflare campaign being distributed on the npm registry: Our research found a total of 24 […] The post ClickFix Phishing Pages Discovered in 24 npm Packages appeared first on OX Security.
Power Plant Cyberattack Underscores the Need to Plan for Operational Continuity
A cyberattack shut down a UK power generator for four days, highlighting how targeted incidents can disrupt operations without threatening the grid.
Golden Paths for AI agents: What changes when platform users aren’t human?
Golden Paths for AI agents require intentional execution patterns, machine-consumable contracts, and dispatch controls. Here’s how to build them.
Managing Shadow AI in the Software Factory: Detection, Evaluation & Policy Enforcement
The post Managing Shadow AI in the Software Factory: Detection, Evaluation & Policy Enforcement appeared first on Anchore.
How to connect Dynatrace MCP to Microsoft Teams using Copilot Studio
A product leader notices a dip in checkout conversions shortly after a release. So they ask on Microsoft Teams: ”Are customers abandoning checkout because of the new experience, or is something else going on?” An engineer starts pulling together information from multiple places: deployment records, service health data, application performance metrics, and user experience telemetry. A […] The post How to connect Dynatrace MCP to Microsoft Teams using Copilot Studio appeared firs
What Is Agentic AI Security? Enterprise Guide
Generative AI fundamentally changed how enterprises process information. Agentic AI is changing how they execute tasks.
Claude Mythos 5 Can Find the Vulnerabilities. But Which Ones Actually Matter?
5 AI Security Maturity Models Compared (2026)
In the span of ten months, the security industry produced more AI maturity models than most teams will ever read... The post 5 AI Security Maturity Models Compared (2026) appeared first on Cycode.
API Penetration Testing: Methodology, Checklist & Tools
Learn how API penetration testing uncovers BOLA, BFLA, authentication, injection, and business logic vulnerabilities—and why continuous runtime testing helps secure APIs between pentests. The post API Penetration Testing: Methodology, Checklist & Tools appeared first on StackHawk, Inc..
Agent Immunization: A New Model for Building Trusted AI Agents
The riskiest thing agents do all day isn’t writing code; it’s “shopping”. Every minute, they reach out to the internet for a package, a plugin, or an MCP server and consume them with no verification or guarantee of what’s inside. Most of the industry is trying to make agents “shop” safely from the outside by …
Why Self-Healing Is the Only Way to Secure at Frontier AI Speed
For twenty years, the software security playbook has worked the same way. You find the vulnerability, score it, open a ticket, assign it to a human, wait for the fix, ship the patch, and prove it happened. Every step in that sequence assumes humans can review each fix individually and still keep up. Frontier AI …
Gunra ransomware: what you need to know
The ransomware gang Gunra has been creating havoc - exploiting unpatched VPNs and firewalls to steal data, encrypt systems, and extort victims across healthcare, finance, manufacturing, and more. Read more in my article on the Fortra blog.
Tune what your reviewers see first: Qodo Advanced Configurations
Qodo recently introduced a set of configurations for tuning code review to your team’s workflow: when reviews run, which standards apply, how much of each finding a developer sees, and which repositories get stricter treatment. In our most recent release we went further. Advanced configurations give teams control over the review comment itself, down to […] The post Tune what your reviewers see first: Qodo Advanced Configurations appeared first on Qodo.
How Aikido finds more vulnerabilities than Mythos at half the cost
Aikido AI Code Audit found 8 more vulnerabilities than Claude Security with Mythos at less than half the cost. How harness design drives coverage per dollar. Category: Research
Red Hat NPM Supply Chain Attack: Runtime Defense Case Against 32 Poisoned Packages in 72 Seconds
A credential-stealing worm poisoned 32 @redhat-cloud-services npm packages in a 72-second burst. Detection would have watched it happen. Here is what stops it.