Policy-as-Code for AI Developers and Autonomous Software Agents
When agents write code, open pull requests, change infrastructure and call tools, written policies and prompts are not enough. Rules have to…
Category
Application Security
50 articles tagged Application Security.
Building a Secure Agentic SDLC: AI That Writes, Tests and Deploys Code
In an agentic SDLC, AI agents take on work at every stage: specifying, coding, testing, reviewing, releasing and operating. This article des…
Runtime Security for AI Coding Agents
Coding agents run commands, read files and make network calls on developer machines and CI runners. Preventive controls reduce the risk, but…
Securing AI Coding Agents: Shell Access, Secrets, Git and Production Credentials
Coding agents run shell commands, read files, use Git and sometimes reach cloud consoles, often on developers' own machines with their crede…
Agentic DevSecOps: When AI Agents Can Write, Test and Deploy Code
Agents now take part in every stage of the delivery pipeline: writing features, fixing findings, triaging failures and preparing releases. T…
AI Agents in CI/CD: Can Agents Test, Debug and Deploy Software?
Coding agents now run inside CI pipelines: triaging failed builds, fixing flaky tests, reviewing pull requests and responding to issues. The…
Building Security Guardrails for AI-Powered Development Teams
This summer delivered a series of warnings for AI-powered development: an agent deleting a production database, a malicious prompt shipped i…
MCP + DevSecOps: Securing AI Agents Inside the Software Lifecycle
MCP servers are now part of how software gets built: developers connect coding agents to repositories, ticketing, CI, cloud consoles and dat…
MCP Security: Securing the Connection Between AI Agents and Tools
A practical hardening guide for security teams responsible for MCP deployments: how to assess MCP servers, configure clients, apply the prot…
Securing AI/ML Software Supply Chains
AI applications are built from models, datasets, notebooks, training pipelines, ML frameworks and serving infrastructure, each with its own…
OWASP for LLMs and Agents: Understanding the New AI Attack Surface
OWASP's GenAI Security Project has published a refreshed 2025 Top 10 for LLM Applications and, last month, a dedicated threat taxonomy for a…
AI Coding Assistants and Security: Who Is Responsible for Vulnerable AI-Generated Code?
When an AI assistant writes a vulnerability and a developer merges it, who is responsible: the developer, the reviewer, the organisation or…
From SAST to AI Security Testing: What's Next for Application Security?
In November, Google reported an AI agent finding an exploitable bug in SQLite before release, and AI-generated fuzz targets uncovering vulne…
How to Review AI-Generated Code Like a Senior Engineer
Google has said more than a quarter of its new code is now AI-generated, then reviewed and accepted by engineers. As AI writes more code eve…
AI Security Testing: How to Red-Team an LLM Application
Most organisations now have LLM features in production, and many have never tested them adversarially. This is a practical methodology for r…
AI-Assisted Security Testing: Finding Vulnerabilities During Development
AI is arriving in application security tooling: automatic fix suggestions for scanner findings, LLM-assisted code review, AI-generated secur…
Securing RAG Applications: Where Retrieval Becomes an Attack Surface
Retrieval-augmented generation is how most organisations connect LLMs to their own data, and it introduces risks that are easy to miss: assi…
Software Supply-Chain Attacks: From Dependencies to Build Systems
The xz Utils backdoor came within weeks of shipping in major Linux distributions after a two-year social engineering campaign against an ope…
LLM Supply-Chain Security: Models, Datasets, Embeddings and Dependencies
Last week, researchers reported around a hundred malicious models on Hugging Face that could execute code on anyone who loaded them. AI appl…
DevSecOps at Scale: Automating Security Across the SDLC
Adding scanners to one pipeline is easy. Running application security across hundreds of repositories and dozens of teams is not: findings p…
AI Red Teaming Meets Application Security
AI red teaming started as something frontier model labs did before releases. With October's US Executive Order on AI and a year of LLM featu…
The Hidden Problems With AI-Generated Code: Security, Bugs and Technical Debt
AI assistants make developers faster, and they also introduce problems that do not show up immediately: insecure patterns delivered with con…
Secure-by-Design: Should Security Become a Software Architecture Requirement?
CISA's secure-by-design guidance, expanded last month with more international partners, asks software makers to treat security as a core bus…
LLM Security Explained: How to Attack and Defend AI Applications
OWASP published its first Top 10 for Large Language Model Applications on 1 August. Meanwhile, researchers have shown automated jailbreaks t…
API Security for Developers: The Vulnerabilities You Should Know
Last month we looked at the new OWASP API Security Top 10 from a security team's point of view. This guide is for the developers who write t…
Secure LLM Engineering: Building AI Applications That Can Survive Attackers
LLM applications are moving into production faster than security practices are forming around them. This article sets out engineering princi…
API Security: The Attack Surface Developers Keep Underestimating
APIs now carry most application traffic, and they expose business logic directly to anyone who can read the documentation or a mobile app's…
Secure by Design: Should Security Start With the Developer?
CISA and its international partners want software makers, not their customers, to carry the burden of security. Their new Secure by Design g…
Prompt Injection: The First Major Security Problem of LLM Applications
Within days of launch, users persuaded Bing Chat to reveal its hidden instructions, and researchers showed that web pages can silently take…
Software Supply-Chain Security: Dependencies, Build Systems and CI/CD
Over the holidays, a dependency-confusion attack hit PyTorch's nightly builds, and in January CircleCI told every customer to rotate their s…
Rust: Why Developers Started Looking Beyond C/C++
Linux 6.1, released this week, is the first kernel with initial support for Rust. Google says Rust is now a significant share of new native…
Infrastructure as Code Security: Finding Vulnerabilities Before Deployment
Infrastructure as code lets teams create cloud environments from reviewed, versioned files, which means cloud misconfigurations can be caugh…
Building Secure Generative AI Applications: What Developers Need to Know
Developers are building products on GPT-3, Codex and Stable Diffusion at a remarkable pace. These applications introduce security problems t…
Generative AI Meets Cybersecurity: What Happens When AI Can Generate Code?
GitHub Copilot became generally available in June, and code-generating models are now part of everyday development. That has consequences fo…
Container Security: Securing Docker and Kubernetes Applications
Containers make applications portable, and they also package operating systems, dependencies and configuration into every image. This develo…
DevSecOps: Bringing Security Into the Development Pipeline
Teams deploy dozens of times a day, and a security review at the end of the release cycle cannot keep up. DevSecOps puts automated security…
AI-Generated Code: Security Risks for Modern Development Teams
AI code assistants are spreading through development teams during Copilot's extended preview, often before security or legal teams have been…
SBOM Explained: Knowing What's Actually Inside Your Software
Last month we covered SBOM standards and policy. This article is for developers and build engineers: how to generate accurate SBOMs from rea…
SBOM Explained: The New Foundation of Software Supply-Chain Security
Log4Shell showed that most organisations cannot say what is inside the software they run. A software bill of materials is the fix the US gov…
Log4Shell: What Log4j Taught Us About Software Supply Chains
Eleven days after CVE-2021-44228 went public, most organisations are still answering a simple question: where do we run Log4j? Here is what…
Machine Learning Supply-Chain Attacks: Models, Data and Dependencies
2021 has been the year of software supply-chain attacks, from Codecov to hijacked npm packages last month. Machine learning teams face those…
Secure Coding Practices Every Backend Developer Should Know
The OWASP Top 10 was updated last month for the first time since 2017, and broken access control is now the number one risk. This practical…
Secrets Management in CI/CD: Stop Putting Credentials in Your Pipelines
The Codecov breach disclosed last month showed how a single tampered script could quietly collect the credentials stored in thousands of cus…
Software Supply-Chain Attacks: Why Your Dependencies Can Become Your Biggest Risk
Two weeks ago, a researcher showed he could run code inside Apple, Microsoft, PayPal and dozens of other companies simply by publishing pack…
Securing CI/CD Pipelines: The New Software Supply Chain
The SolarWinds compromise disclosed this month shows that attackers can turn a vendor's own build process into a distribution channel for ma…
The Software Supply Chain Behind Machine Learning
Machine learning projects are built on a deep stack of open-source frameworks, Python packages, pre-trained models and public datasets, ofte…
Machine Learning for Software Testing and Bug Detection
Testing and bug-finding consume a large share of engineering time, and machine learning is starting to help: predicting which tests to run,…
ML Security vs Traditional Application Security
Application security teams are increasingly asked to review systems with machine learning at their core. Some of their existing knowledge tr…
Shift Left Security: Why Developers Need to Own Security
'Shift left' means finding and fixing security issues earlier in development, where they are cheaper and faster to fix. That only works if d…
DevSecOps Explained: Bringing Security Into the Software Development Lifecycle
DevOps made software delivery continuous; DevSecOps makes security continuous too. Beyond the buzzword, it is a set of practices that put se…