Showing Post From Security
SBOMs in 2026: revisit Syft, cdxgen and Dependency-Track before you hand another customer an SBOM nobody tracks
Many product teams have lived this week. A large customer’s security questionnaire asks for “an SBOM for the current release”. Someone runs a tool on the release branch and emails a few megabytes of JSON.
Read moreLLM guardrails in 2026: revisit NeMo Guardrails, Guardrails AI and LLM Guard before you ship another chatbot without input checks
An internal chatbot can look ready after a few happy-path demos. Then someone pastes a payroll CSV into the prompt, tries a jailbreak that worked on a public model last month, or asks the bot to call a tool with a destructive argument.
Read moreTeam password managers in 2026: revisit Vaultwarden, Passbolt and Psono before you share another password in a spreadsheet
In most small companies the first password manager is a spreadsheet. It starts with five rows: the domain registrar, the office router, the AWS root account, the payment gateway dashboard and the Wi-Fi.
Read moreInfrastructure access in 2026: revisit Teleport, Boundary and Warpgate before you hand out another SSH key
Every engineering team has an access story it does not like to tell. A new developer joins, and someone appends her public key to authorized_keys on fourteen servers by hand.
Read moreWeb application firewalls in 2026: revisit ModSecurity, OWASP Coraza and BunkerWeb before you put another WAF in front of your app
A web application firewall is one of those things that gets added after a bad week. A penetration test report arrives, or a customer sends a security questionnaire with a line that says “Do you use a WAF?
Read moreStatic code analysis in 2026: revisit Semgrep, Opengrep and SonarQube Community Build before you add another code scanner to CI
Most teams add a code scanner to CI in an afternoon. A YAML job, a default rule pack, a green tick.
Read more