How Agentic Pentesting Separates Test Failures From Real Security Findings
Agentic pentesting reliability on unstable apps: a six-state failure taxonomy, safe retry rules, and what a trustworthy pentest report must disclose.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,929 matching stories — in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Vulnerability Chaining: How Agentic Pentesting Proves Attack Paths
Three low-severity findings can chain into one critical breach. See why CVSS misses chained risk and how agentic pentesting proves or rejects each attack path.
10 Best Open Source Agentic Pentesting Tools in 2026
Compare the 10 best open source agentic pentesting tools for self-hosted workflows, from PentAGI and PentestGPT to CAI, Strix, and VulnBot.
What SCA Can't Tell You About Product Risk
Product security leaders need more than a CVE list per repo. Here's what it takes to understand risk across the full product hierarchy before it ships.
The White House Is Right About Quantum. Here Are the Hot Takes. | Manifest Cyber
The White House signed two quantum executive orders yesterday. The direction is right. The CBOM mandate is meaningful. But the 2030 deadline is a bet, the procurement gap is real, and treating CBOMs as separate from SBOMs adds confusion to a field that can't afford it.
VicOne Brings Physical AI Safety Stress Test to DEF CON 34 to Test How Cyber Risk Can Change Robot Behavior
Digital twin CTF challenge helps robotics makers and operators identify cyber-to-safety risks through Physical AI security scenarios before deployment.
The Hidden Cost of Legacy C++
By Sarah Riggins and Dr. Denis Gopan The Memory Safety Reckoning: Part 2 of 4 The post The Hidden Cost of Legacy C++ appeared first on GrammaTech.
Phoenix Security Launches Phoenix Purple: Security That Lives Inside Your Coding Agent, Before the Pull Request
Phoenix Security launched Phoenix Purple, an engineering-first security platform that scans AI-generated code before the pull request. Graph-native intelligence cuts scanning token costs by 10 to 33 times and delivers fixes as pull requests, closing the gap between how fast agents write code and how fast security can respond. The post Phoenix Security Launches Phoenix Purple: Security That Lives Inside Your Coding Agent, Before the Pull Request appeared first on Phoenix Security.
Comparing Vulnerabilities Across Image Versions via the Anchore Enterprise API
The post Comparing Vulnerabilities Across Image Versions via the Anchore Enterprise API appeared first on Anchore.Through the Looking Glass: Tweedledee and Tweedledum This is post 6 in a seven-part series on what the Anchore Enterprise API makes possible for container security teams.  Tweedledee and Tweedledum stood under their tree looking nearly identical — same coat, same posture, same expression — and Alice could only tell them apart by the collars […]
FOSS Notices Are Still Being Managed Like It's 2009
Open-source compliance has a quiet operational problem.
Best SAST Tools in 2026: A Practical Comparison for Engineering Teams
TL;DR Fast-moving teams shipping across multiple projects simultaneously do not have the luxury of treating security as a gate at...
Adnovum launches Entrepreneur in Residence Program with Trust Valley and welcomes Hafnova as first participant
Adnovum has launched an Entrepreneur in Residence (EiR) Program in collaboration with the Trust Valley initiative powered by the EPFL Innovation Park Foundation. The program aims to foster collaboration between Adnovum and innovative technology companies and to accelerate the development of next-generation digital and cybersecurity services.
SBOM 의무화 시대, SW 공급망 보안은 어떻게 준비해야 할까요?
What Is an AIBOM? AI Bill of Materials Guide | Cybeats
Learn what an AI Bill of Materials (AIBOM) is, what it contains, how to generate one with the OWASP AIBOM Generator, and how to manage AIBOMs at scale.
More than just data: The hidden security risks in Jupyter notebooks
Are your data science tools safe? Sonar researchers uncover vulnerabilities leading to code execution in JupyterLab Desktop and PyCharm.
The API Self-Check: How Hackers Find the Endpoint You Forgot About
Run 6 quick checks to find exposed API endpoints, broken auth, and data leaks before attackers do. See how AppTrana secures APIs continuously. The post The API Self-Check: How Hackers Find the Endpoint You Forgot About appeared first on Indusface.
AI didn't break coding. It broke code review.
Agents ship code faster than teams can review it. Go inside Morgan Stanley's fix for the AI code review bottleneck: risk-based PR routing at scale
Why security champion programs stall, and what AI fixes
Most security champion programs stall from unfunded ownership, not unwilling developers. Where AI actually removes the busywork, and where it changes nothing. The post Why security champion programs stall, and what AI fixes appeared first on Clover Security.
Claude Sonnet 4.6 code quality: we tested it with and without AI guardrails
03.07.2026 Reading time: 7 minutes We put Claude Sonnet 4.6’s AI code quality to the test Werner Heijstek In this article Summary We ran a controlled experiment on Claude Sonnet 4.6, building the same system 20 times with one variable changed: whether a real-time, deterministic quality and security check sat inside the agent’s loop. The […]
DORA vs SPACE Metrics: Key Differences, Use Cases, and When to Use Each Framework
Why Engineering Teams Need More Than One Measurement Framework For many years, organizations relied on activity-based metrics to evaluate engineering...
How To Set Up Enterprise Development Environments with OpenAI Codex and Coder
Run OpenAI Codex in self-hosted cloud development environments built for regulated enterprises. See how Coder secures AI coding agents at scale.
Tool Sprawl Is Dead: But Did Consolidation Actually Fix Anything?
TL;DR Platform consolidation reduces vendor management overhead and simplifies dashboards, but it doesn't solve the fundamental visibility problem. Security teams consolidating SAST, DAST, SCA and WAF into a unified application security platform still miss application-layer attacks because these tools don't see inside running applications. The math proves it: organizations face 17.5 new vulnerabilities per application monthly while remediating only 6 per application. Runtime intelligence provide
The Underappreciated OSS License Compliance Risk from AI Coding Tools
Learn about an under-the-radar IP risk from the use of AI coding assistants.
Shifts in the Supply Chain: How Ransomware Targets Global Logistics Fleets
VicOne CyberThreat Research Lab identifies key vulnerability classes in fleet-related applications, underscoring the need for stronger security across connected fleet platforms.
Tenable Named as the Current Company to Beat for AI-Powered Exposure Assessment in a June 2026 Gartner® Report
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced that Gartner has identified Tenable as the company to beat for AI-powered exposure assessment in its report, AI Vendor Race: Tenable Is the Company to Beat for AI-Powered Exposure Assessment.According to Gartner, "Tenable's long-standing dominance in vulnerability assessment, its strong asset and attack surface discovery capabilities, and its ability to execute on its AI strategy make it the front-runner in
SonarQube plugins bring trusted verification to Claude Code, Copilot, Codex, Cursor, and others in the agentic loop
Eliminate verification debt with plugins & how to secure AI coding agents across Claude, Copilot, and Cursor using SonarQube. Reduce code outages by up to 44%.
[2026.06] Threat Intelligence Report
Status of High-Risk Vulnerabilities No. Vulnerability No. (CVE) Content CVSS Risk Level 1CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass10CRITICAL 2CVE-2026-43898SandboxJS Sandbox Escape RCE10CRITICAL 3CVE-2026-45102OneUptime Sandbox Escape RCE9.9CRITICAL 4CVE-2026-0300Palo Alto Networks PAN-OS User-ID Authentication Portal 9.8CRITICAL 5CVE-2026-8181WordPress Burst Statistics Plugin Authentication Bypass9.8CRITICAL 6CVE-2026-34187Pandora FMS SQL Injection9.8CRITICAL 7CVE-202
Introducing our Free plan: making security accessible for the 99%
Professional security tooling, free forever. Intruder's new free plan is built for lean teams who face enterprise risks on a fraction of the budget.
AIS Outlines Research Collaboration Opportunities with SUNY Poly at SPARK Workshop
... The post AIS Outlines Research Collaboration Opportunities with SUNY Poly at SPARK Workshop appeared first on Assured Information Security.
Contaminated by Design: What Clinical Trials Can Teach AI Security Researchers
TL;DR This is a story about a contaminated experiment, a single directory name and why AI coding security research needs the same blinding discipline as clinical trials.
Introducing Sonar Vortex and the SonarQube Remediation Agent
Sonar Vortex guides and verifies AI agent output in real time. SonarQube Remediation Agent is now GA. 92% fewer issues. Up to 36% lower token costs.
Infosec professionals sour on automated pentesting tools
Chasing Zero-Day Vulnerabilities via the Anchore Enterprise API
The post Chasing Zero-Day Vulnerabilities via the Anchore Enterprise API appeared first on Anchore.Through the Looking Glass: Who Stole the Tarts? — Chasing the Cheshire Cat This is post 5 in a seven-part series on what the Anchore Enterprise API makes possible for container security teams.  “Well! I’ve often seen a cat without a grin,” thought Alice, “but a grin without a cat! It’s the most curious thing […]
The CRA Deadline Is Not 2027. Your Evidence Problem Starts Now.
Many product and security teams are treating the Cyber Resilience Act as a 2027 problem.
What’s Unifying Americans in Polarizing Times? Scams.
The post What’s Unifying Americans in Polarizing Times? Scams. appeared first on Feedzai.
Why Alibaba Cloud Visibility Is Becoming a Strategic Priority
Discover why cloud visibility is becoming a strategic priority for Alibaba Cloud, helping organisations strengthen security, governance and risk management. The post Why Alibaba Cloud Visibility Is Becoming a Strategic Priority first appeared on ArmourZero.
How to Reduce False Positives by 76% with Repo Context
Traditional SAST buries teams in false positives because it can't see how an app runs in production. Adding repository context — plain-language facts about deployment, trust boundaries, and authentication — cut candidate issues 71-76% across two repositories, with zero high-severity bugs lost.
What your scanner can’t see: Deep visibility into hardened container images with Black Duck
If you’ve ever stared down a vulnerability report and thought “there is no way all this is real,” you’re not wrong. Modern containerized environments generate a lot of noise, findings that technically exist somewhere in the file system but have zero chance of being exploited in your running app. That’s part of why security-conscious teams […] The post What your scanner can’t see: Deep visibility into hardened container images with Black Duck appeared fir
PSD3 and the PSR: What Financial Institutions Need to Know
The post PSD3 and the PSR: What Financial Institutions Need to Know appeared first on Feedzai.
How Agentic AI Enables Autonomous Threat Response at Machine Speed
Why do 40% of alerts received by security teams today go completely uninvestigated? It’s not due to a lack of concern but instead caused by shortening attack windows and compounded by overwhelming tech sprawl. Today’s security teams are operating in a threat landscape defined by escalating attacks, tighter budgets and mounting alert fatigue. Organizations process an average of 960 security alerts per day, and large enterprises handle more than 3,000 daily alerts across roughly 30 tools. That add