The AI Slop Discourse Is Missing the Point: Your "Authoritative" Security Guidance Might Be Worse

Why I'd rather trust Claude with my Go security code than a 5,000-star OWASP project

How to Stop Writing Sh*t Prompts Like I Used To

Care Less, Protect More: Why Security Tools Can't Save Us From Open Source Vulnerabilities

Code Sprawl is the Sleeper Cell of Vibe Coding

What is going to happen when the whole world becomes developers creating code? Spoiler alert: Some problems today are going to get exponentially worse.

When "You Could Be Hacked" Is the Best We've Got

Most GenAI security lists miss the mark. Here’s what developers actually need to build secure software with real tools and context.

Seeing What Matters Starts with Shadow Engineering Detection

Shadow engineering is the new shadow IT. Learn how Crash Override helps you uncover it early, align Dev and Sec, and build faster with less risk and more control.

Hooray! Security Teams May Still Be Accountable for Secure Software, but Developers Are Now Taking Responsibility for It and Here Is Why

RSA 2025: Lost in the Petting Zoo, Searching for Signal

The Curious Case of Shadow Engineering

Code Ownership and Code Owners Files

Chalk has a new home

The Business Value of Engineering Relationship Management

Introducing Engineering Relationship Management

Opengrep - The Security Industry Deserves Better

Security Marketing Exposed - Part One

Whack-a-mole is dead

On Social Media Witch Hunts and Learning Important Lessons

Is Shadow Development Really A Problem?

Are there too many bubbles of similar security efforts?

Welcome ZAP to the Open Source Fellowship

The Crash Override Open Source Fellowship

SBOMs for Production Incident Response Maybe a Killer Trojan Use Case for Security

Best-of-Breed and Industry Standard is Misleading

The Power of Small, Fast, Grit and Cross-Functional Relationships

Build System or Bust and Wrapping Security Tools Using Docker

Security Quackery

How can you have any pudding if you don't eat yer meat?

Why open core, GPL and dual licensing is a model that works

The curse of AI in the security industry

Five Questionable Things About Top Ten Security Lists

Chalk is now officially open-source

Building Security Tools is the Wrong Approach

We Need Modern Product Security Certification And We Need It Now

Why you should not give a f*ck about security awards

The Hackers Mural - Amsterdam April 2023

Creating Art Not Junk - The Hack in the Box Treasure Hunt

How AI might affect DevSecOps

Is developer led, the best strategy for the adoption of security tools?

Security Tools Can't Just Be Friction Free. Was SCA the Tipping Point?

Less AppSec Assessment and Protection, More DevSecOps Observability

Developers Only Pay Lip Service to Security. Get Over It.

Could sports advertising be a valid model for for open-source security?

Why are the same old appsec issues still a thing in 2023?

We don’t need more bloody appsec tools

DevSecOps is better than appsec

Why security companies and communities come and go

On the left, on the right and wiggle in the middle

Why supply chain security is so much more than open source code and CVE’s

In the future, can you have your appsec cake and eat it as well ?

CVE / NVD doesn’t work for open source and supply chain security

CVE / NVD doesn’t work for open source and supply chain security

A Security Tools Crash Is Coming

A Personal History of the AppSec Industry

Don’t Blame the Players, Blame the Game

What The Bloody Hell Is An Application ?

Introducing the Github Analyzer

Dependency Pinning Only Works If You Actually Review the Updates

Designing the Crash Override brand and the Hackers movie

What I Learned About Information Security From Academia

Why SCA for Security is Really Hard

The AppSec letter bomb problem

The SBOM frenzy is premature

The CSO Interviews - the biggest unsolved problems in security today