GitHub Secret Scanning: Why a Small Model Beat the LLM Pipeline
GitHub secret scanning swapped an LLM for a fine-tuned ModernBERT classifier: 86% faster scans, 98% lower cost, fewer false alarms. How it works for teams.
Datadog Observability Pipelines Now Routes Security Logs to Exabeam — Without Blinding Your SIEM
Datadog Exabeam Packs filter Cisco ASA, CrowdStrike, and Palo Alto logs before SIEM ingest — cutting costs while keeping threat-relevant signals intact.
The First 72 Hours of Ransomware: Why 'Restored Isn't Recovered' Changes Your Incident Response Plan
Restoring systems isn't recovering the business. Ransomware's first 72 hours need data validation, dependency checks, and SIEM mapped to MITRE ATT&CK.
Datadog Supply Chain Firewall: Block Malicious npm and pip Packages Before They Install
Datadog's open-source Supply Chain Firewall checks npm, pip, and poetry installs against threat databases and blocks malicious packages before they install.
Datadog Workload Protection Can Now Kill Processes and Isolate Workloads Mid-Attack
Datadog's Workload Protection has added automated and manual response actions — kill offending processes and isolate compromised containers — closing the gap between detection and remediation without a human handoff.
India's Regulatory Wave: The 5 Security Controls Every Organization Needs Now
DPDP, SEBI CSCRF, CERT-In, and RBI data localization all demand the same five controls. HashiCorp Vault and Boundary address most of them directly.
Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles Are Now GA
Kubernetes v1.37 graduates Pod Certificates and Cluster Trust Bundles to stable. They replace bearer token JWTs with proof-of-possession mTLS credentials — closing a workload identity gap that has existed since the beginning.
Kubernetes v1.37 Pod Certificates: Why Bearer Tokens Were Never Enough
Pod Certificates and Cluster Trust Bundles hit GA in Kubernetes v1.37, replacing bearer token identity with proof-of-possession X.509 credentials.
Coding Agents Are Pulling Packages Your Security Team Can't See
AI coding agents like Cursor and Claude Code bypass traditional package governance by pulling dependencies directly from public registries. JFrog's agent package resolution closes that gap before the next supply chain incident.
Agent Immunization: The Software Supply Chain Security Model Built for AI Speed
JFrog's agent immunization framework embeds trust enforcement inside what AI agents consume—not at the perimeter—because perimeter security cannot keep pace with agentic development velocity.
How Bedrock AgentCore Propagates User Identity to JFrog Artifactory — and Why It Matters
When an AI agent calls a tool on behalf of a user, who gets the audit trail? Bedrock AgentCore's On-Behalf-Of token exchange solves the shared-credential problem that makes agent-to-Artifactory calls untrustworthy.
Datadog Risk AI: How Systemic Risk Detection Moves Beyond Individual Findings
Datadog's Risk Engineering team built an AI agent layer that correlates security signals across vulnerability, identity, and exposure dimensions — recognizing that severity and risk aren't the same thing.
AI Just Found a 27-Year-Old Vulnerability. Your AppSec Stack Wasn't Built for This Speed.
Claude Mythos Preview independently found and weaponized a 27-year-old OpenBSD flaw, a 16-year-old FFmpeg bug, and a 17-year-old FreeBSD RCE. JFrog's analysis explains why fragmented security tooling can't keep up.
Packer v1.16.0 Brings SLSA Provenance to Machine Images — Here's What That Means
HashiCorp's Packer v1.16.0 adds native SLSA provenance generation and verification to machine image builds. The result: cryptographically signed build records, four signing modes, and packer verify-attestation for enforcement pipelines.
Datadog's Azure Integration No Longer Needs a Secret to Rotate
Secretless authentication replaces static client secrets with OIDC-based federated identity. No expiration dates, no rotation schedules, no telemetry gaps when someone forgets to update a credential.
Unfixed Kubernetes CVEs: What You Can and Can't Actually Detect
Four Kubernetes CVEs have been unfixed since 2020–2021 — not because they were overlooked, but because patching would break the platform. Here's how to know if your cluster is actually exposed.
Understanding Unfixed Kubernetes CVEs: What You Can — and Can't — Detect
Four Kubernetes CVEs remain unfixed because patching would break the platform. Datadog's guide to audit-log-based detection shows what each one exposes — and the honest limits of what audit logs can confirm.
Agentic Dev Security Starts Before the Agent Writes Its First Line
JFrog's Ohad Shalev argues most agentic development security tools watch what agents build but miss what they consume before they start — and that gap is where the real attack surface lives.
SLSA and DevGovOps: Why Software Supply Chain Governance Now Runs at Machine Speed
AI agents generate code faster than human governance frameworks can review it. DevGovOps — continuous governance embedded in CI/CD — is the response, and SLSA provides the maturity model. Here's how JFrog's implementation works.
swampUP 2026: JFrog's Conference Puts AI Supply Chain Trust at the Center
swampUP 2026 in New York (September 1–3) focuses on immunizing, healing, and governing the agentic software supply chain. Anthropic's Deputy CISO, NVIDIA, AWS, and Wiz are on the agenda. Here's what to expect.
Datadog's Mambark: A 97M-Parameter Filter That Cuts AI Security Costs 10,000x
Datadog's Mambark, a 96.9M-parameter state-space model, screens 10 billion daily security events down to ~10,000 candidates before an AI agent ever runs.
An OpenAI Model Found a Zero-Day in Artifactory. JFrog Patched It Fast.
OpenAI's models autonomously chained vulnerabilities to escape a sandbox and reach Artifactory infrastructure — a preview of what 'AI as attacker' means for patch response times.
AI Coding Speed Is Outrunning Secrets Security
Nearly 30 million secrets leaked on GitHub in 2025 (up 34% YoY). AI-assisted code leaks at nearly 2x the rate. What DevOps security teams should do now.
Datadog's MCP Security Agents: What Production Looks Like Beyond the Demo
Datadog built MCP tools for Cloud SIEM operations and published the engineering decisions. Progressive disclosure cut token usage 41%. Here's the architecture.
CVE Severity Scores Are Inflated: JFrog's 96% Finding
JFrog's security team found 96% of critical CVEs warranted a lower rating. Their prototype pollution research exposes why CVSS scores routinely misrepresent real-world exploitability.
Why Uniform AI Agent Governance Fails — and What to Do Instead
Gartner projects 40% of enterprises will demote or decommission AI agents by 2027 due to governance failures. JFrog's analysis of why one-size-fits-all governance breaks down, and the tiered alternative.
Mutation Testing: What Platform Teams Are Missing With Code Coverage Alone
Code coverage tells you which lines ran. Mutation testing tells you whether your tests would actually catch a defect. For platform teams shipping infrastructure-affecting code, the difference is the gap between 'tests passed' and 'tests work'.
Checkmarx's New SAST Engine Isn't About the LLM. It's About What Comes After.
Checkmarx unveiled a hybrid SAST engine with three components — a deterministic scanner, an LLM trained on security data, and a Finding Analysis Engine that filters false positives before results reach developers. The differentiator is the last one.
JFrog Artifactory Adds Xet Protocol Support: How Enterprise Model Distribution Finally Scales
JFrog Artifactory's native Xet protocol support brings chunk-level deduplication to Hugging Face model distribution — delivering up to 3.7x faster subsequent pulls and controlled storage growth for enterprises managing fine-tuned model variants.
PixelSmash: The FFmpeg Heap Overflow That Turns Media Files Into Attack Vectors
CVE-2026-8461 is a CVSS 8.8 heap out-of-bounds write in FFmpeg's MagicYUV decoder — enabled by default, triggerable without user interaction, and already demonstrated as RCE against Jellyfin and Nextcloud.
JFrog Named a Leader in the First-Ever Gartner MQ for Software Supply Chain
JFrog placed highest for Ability to Execute in the inaugural Gartner Magic Quadrant for Software Supply Chain Platforms — the first analyst framework to evaluate this market as a unified category.
npm v12's Biggest Security Change: Installation Scripts Now Need Your Permission
npm v12 disables lifecycle scripts, Git dependencies, and remote URL resolution by default — an explicit trust model that blocks 53% of malicious npm attacks and requires teams to audit their CI/CD pipelines before upgrading.
AI Writes Rego Fast. JFrog's AppTrust Playground Validates It Against Real Artifacts.
OPA dominates policy-as-code at 62% of all policy files. AI tools generate it in seconds. JFrog's Policy-as-Code Playground closes the gap between AI-generated Rego and production-safe policy.
JFrog Brings Xray Security Data Into Amazon Kiro With a New Open-Source Power
JFrog Power for Kiro adds artifact search, repository management, and live CVE data from JFrog Xray directly into Kiro's MCP-native IDE — closing the gap between AI-assisted coding and security validation.
When AI Attacks at Machine Speed: The End of Static Credentials
An exposed AWS key can be pivoted to database access in 18 minutes by an AI agent. Why static credentials are no longer a viable security posture.
How to Secure Kubernetes in the Age of AI Workloads: A Four-Layer Approach
AI agents on shared Kubernetes clusters are dynamic, bursty, and frequently egress-heavy — a threat surface that traditional NetworkPolicy wasn't designed for. Here's the four-layer approach that addresses it.
Snyk Evo: Continuous Pentesting to Match the Pace of AI Code
Traditional pentesting averages 15 days of coverage per year. Snyk Evo runs AI agents against your application stack continuously. Here's the architecture and the gap it closes.
GitLab 19.0: Secrets Manager, Agentic Merge Requests, and the DevSecOps Platform Bet
GitLab 19.0 ships native secrets management, agentic merge request tools, and self-hosted open source models — a major DevSecOps platform update.
Datadog's Open Source AI SAST: 90% Detection, Fewer False Positives
Datadog released an open source AI-native SAST tool that hits 90% command injection detection on OWASP benchmarks — up from 59% with traditional rules. Here's the architecture and why false positives were the real problem.
Datadog CI/CD Threat Matrix: A MITRE Framework for Pipeline Security
Datadog published a MITRE ATT&CK-style threat matrix for CI/CD pipelines — 10 attack tactics mapped to the specific exposure points where compromised pipelines ship malicious code.
Betterleaks: The Gitleaks Successor Built for Agentic Secrets Scanning
Gitleaks creator Zach Rice rebuilt the tool from scratch with 98.6% recall, CEL-based validation, and CLI design built for AI coding agents operating code pipelines.