CVE-2024-3094, Open Source Security, and VulnCon - Is there any hope? I’ve never been so sure that vulnerabilities are both critical, and don’t matter at all. This last week was VulnCon in my very own Raleigh, NC. Overall, the main benefit was seeing just how human our vulnerability
If you want a guaranteed winner LinkedIn post, here’s a free template: “Companies are not taking LLM security seriously enough, researchers got {Popular LLM} to reveal {Nothing That Sensitive}. The security industry can be really susceptible to VC trends, because for every “mind blowing new technology” comes along with
This week I met with Kodem. Kodem has entered into the narrow but exciting world of granular runtime vulnerability detection alongside Oligo, offering a function level view of dependencies based on eBPF logs. A lot of the content here is also covered in the latest YouTube video. This led to
This is not a post meant to bash CVEs, especially with the recent drama around the issues at the NVD. Instead, I’m arguing that CVEs are the baseline for supply chain security, not the end goal. Table of Contents * Are CVE's really the best we can do?
Every week I have formal and informal conversations with a lot of vendors. I often have much more to say about them than what fits in my weekly update posts. In order to better talk about some of the trends that I see on a weekly basis, this weekly newsletter
Disclaimer: Gartner has decided to call these vulnerability management platforms ASPM, which you can read my opinion on over here. I call them what they are - remediation platforms, or with even less marketing pizazz, vulnerability management platforms. Why? Because they help manage vulnerabilities and get them fixed. Let’s
Every ASPM provider provides some combination of the above capabilities. Application Security Posture Management (ASPM) is the latest Gartner fueled buzzword to take over cybersecurity, but no one knows exactly what it is. On the one hand, it’s a fancy name for vulnerability management: helping ingest and prioritize vulnerabilities
Kubernetes Security Scanning…and more? Kubernetes security and visibility lie at the heart of most cloud security startup innovations. Because the field is so complex and growing by the day, it’s easy to lose track of who’s really doing what, and which products merely exist as checkboxes versus
Latio’s OWASP Conference Vendor Awards The Global OWASP Conference in Washington DC was a ton of fun, getting to hear from many in the industry facing the same application security challenges as one another. The major theme was that AppSec is for everyone - everything from better products to
Learn more about runtime protection from Spyderbat: their history, platform, use cases, pros, and cons. As always, nothing in this post is sponsored or AI generated! Overview Cloud configuration and vulnerability scanning were the first frontier of cloud native security startups for a reason: frankly, it was easy. Open source