Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,928 matching stories — in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Frontier models can detect real vulnerabilities at scale. They reason across application logic, analyze authorization flows, identify multistep vulnerabilities, and propose context-aware remediation. That capability is real. But it can lead to a risky conclusion: that frontier model scanning alone can carry the weight a layered defense was built to distribute. Detection and assurance are […] The post AI application security needs both reasoning and assurance appeared first on Black Duck.
Application security teams are moving from detection-only workflows toward tools that can also help remediate issues. For years, the main goal of AppSec was finding the vulnerability. Scanners got faster, rules engines got smarter, and alert volumes grew. Today, finding the flaw is rarely the bottleneck. Fixing it is.
Onyx alternatives are hard to shortlist because the AI agent security market has split into two different jobs. The first is securing endpoint, SaaS, and cloud AI agents, the productivity layer where employees use coding assistants, browser AI, and copilots to work faster. The second is AI application security: securing the actions that custom-built AI ... Read more The post Onyx Alternatives: Enterprise AI Agent Security Platforms Worth Evaluating in 2026 appeared first on Rein Security.
An autonomous AI breach at Hugging Face and Anthropic's Fable suspension show the same thing: trusting a vendor isn't the same as being in control Category: News
A bank isn’t just a vault holding money. It is an engine powered by implicit public trust, sustained by the continuous confidence that funds remain secure and accessible on demand. When operational risks fail, whether through cyber breaches, system outages, or third-party vulnerabilities, that trust shatters, threatening not just an individual institution, but the stability …
The combination of Dynatrace and Arize will bring together AI-native evaluation, open AI instrumentation, and unified observability to help organizations evaluate, operate, and continuously improve AI applications from development through production at enterprise scale. The post Dynatrace and Arize bring full-lifecycle observability to AI applications appeared first on Dynatrace news.
The first generation of AI coding tools was built around a simple loop: prompt, generate, accept. That loop works surprisingly well for producing code. It is much less reliable at deciding whether a change belongs in a real production system. Code governance is the continuous work of keeping software aligned with an organization’s requirements, standards, […] The post How Qodo Builds the Wisdom to Govern, Part 1: The Context Engine appeared first on Qodo.
Technical debt topped SAP's own survey of what blocks developers. Harald Aamot on the ROI case, the recipe community, and holding remediation to a steady rate
I began building durable agent-work controls before loop and graph engineering became pervasive terms. The architecture points to a larger conclusion: code review is an essential verification layer, but governed software delivery requires an outer SDLC control plane. AI code review was the first boundary I could see very clearly. As coding agents increased the […] The post Moving from AI Code Review to the Outer SDLC Loop appeared first on Qodo.
Software companies used to worry about someone walking out the door with a hard drive... The post Intellectual Property Leakage: Risks, Detection, and Prevention appeared first on Cycode.
AI agents now write code, pull dependencies, run tests, and open pull requests inside enterprise pipelines, sometimes without a developer ever opening an IDE... The post Agentic Development Lifecycle (ADLC): What You Need to Know appeared first on Cycode.
'Assume compromise' has a precise operational conclusion most incident response plans skip. Here are the four coordination requirements that follow from the premise and explains how to verify whether your current architecture meets them.
If you haven't reviewed your external perimeter updates from earlier this month, here is what trended across the security community, & what entered CISA's KEV catalog.
Why npm malware keeps reaching for Bun: how attackers abuse install-time scripts, why Bun helps them evade Node-based defenses, and the controls that actually reduce risk.
SwyftComply AI closes the vulnerability discovery-to-protection gap before attackers exploit it. Autonomous protection, expert-verified, audit-ready. The post SwyftComply AI: How We Turn Vulnerability Flood Into Audit-Ready Protection appeared first on Indusface.
Last week was the second time I've attended Black Hat, the first being over a decade ago, and it has certainly grown. The production value of the briefings and especially the keynotes was incredible, the vendor area was larger and grander, and the attendees were more numerous, swarming, even. That is to be expected though with one of the main security conferences on the planet. Last time I was there, the hot topic was IoT; this year, as you could have guessed, AI was mentioned in nearly every ke
Generative AI adoption moves faster than traditional security frameworks can manage. Engineering teams are embedding large language models into enterprise applications at unprecedented speeds. Meanwhile, security teams are often left discovering these implementations long after deployment. This disconnect creates a real enterprise readiness gap.
Teams running containerized workloads on Google Cloud have long relied on JFrog as their single source of truth for container images. The missing piece has been getting Google Cloud’s own runtime services — like Cloud Run and Google Kubernetes Engine (GKE) — to pull directly from JFrog for every container image pull. I’m happy to …
SAST, Deep PR Review, Code Security Audit and AI Pentest each catch different vulnerabilities at different stages. Here's when to use each, and why Category: Product & Company Updates
Something shifted in security operations over the last two years: AI stopped being a pilot program and became the plan.And if you survey 500 security professionals on whether that's going well – as Omdia did, commissioned by Rapid7 – you get a remarkable level of consensus: 97% report positive outcomes, 98% say AI reduces alert fatigue, and 95% say it's helping address staffing shortages.Those numbers are high enough that the story could stop there; AI is working, everyone agrees. Move on. But t
Im Juli 2026 tauchten zahlreiche neue Risiken für IT-Sicherheitsverantwortliche in Unternehmen auf. Anfang Juli haben wir in unserem Blog über neue Probleme berichtet, wie beispielsweise die aktive Ausnutzung von Schwachstellen im WordPress-Core [2], Adobe ColdFusion [3] sowie Check Point SmartConsole [4]; neue Schwachstellen mit kritischem Schweregrad in Cisco-Produkten [5], BeyondTrust RS und PRA [6] sowie […]
Im Juli 2026 tauchten zahlreiche neue Risiken für IT-Sicherheitsverantwortliche in Unternehmen auf. Anfang Juli haben wir in unserem Blog über neue Probleme berichtet, wie beispielsweise die aktive Ausnutzung von Schwachstellen im WordPress-Core [2], Adobe ColdFusion [3] sowie Check Point SmartConsole [4]; neue Schwachstellen mit kritischem Schweregrad in Cisco-Produkten [5], BeyondTrust RS und PRA [6] sowie […]
A critical CVE lands in your backlog... The post Agentic SCA: Triage, Mitigate, and Fix Exploitable CVEs Without Breaking Changes appeared first on Cycode.
Originally published on the Hacker News here. A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, […] The post AI Recommendation Poisoning: How “Ask AI” Buttons Silently Alter LLM Memory appeared first on Reflectiz.
CVE-2026-55040, a critical SharePoint authentication bypass, is now being actively exploited. A proof-of-concept went public on August 11. Within 24 hours, threat intelligence firm Defused confirmed exploitation attempts against its. The post SharePoint CVE-2026-55040 Actively Exploited: AI-Discovered RCE Chain appeared first on Indusface.
The Agent Baseline defines 35 controls across six security outcomes—but the right starting point depends on how your organization uses agents. Learn how to sequence controls for coding, internal, and production agents.
Pinning GitHub Actions to commit SHAs is an effective supply chain defense, but annoying to do org-wide. Here's how I did it, and what I'd do differently.
Recent incidents involving autonomous AI models breaking containment, generating deceptive exploits, and covertly inserting vulnerable code into software projects mark a dramatic shift in application security. As organizations increasingly rely on AI tools to write code, the potential for AI-inserted vulnerabilities and automated exploits grows exponentially. Waratek Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) provide a dual-layer defense system
Many application security programs still create more remediation work than engineering teams can realistically absorb. For over a decade, security teams have relied on scanning tools that generate thousands of alerts, pass them over the fence to engineering, and expect developers to drop their current priorities to fix them. This approach creates bottlenecks, slows down release cycles, and leaves critical vulnerabilities lingering in production environments.
Ivanti releases standard security patches on the second Tuesday of every month. In today’s rapidly evolving technology and threat landscape, we believe responsible transparency should be a cornerstone of any product security program. AI is compressing the time-to-exploit, and Ivanti uses leading technologies to proactively find and fix issues ––including integrating advanced LLMs into our Engineering and product security to enhance the capabilities of our teams. Our philosophy is simple: discove
