This post focuses on using SBOMs and vulnerability data and explains why most vulnerability data is not up to the job.

John Viega shares his position on the industry implications for the conviction of Joe Sullivan, the former CISO of Uber in a case about breach reporting.

This blog explains why code signing doesn't help address open source dependencies that contain malware.

This article explains why the current use cases for SBOMs are not complete and why the Securing Open Source Software Act of 2022 is flawed.

We asked over 50 leading CSOs and appsec leaders what their biggest unsolved problems were and then sat back and listened. This is what we heard.