Security

This article describes why supply chain security is about all of the upstream and downstream dependencies that modern applications rely on and not just open source libraries.

Part two of my article about what is wrong with CVE/NVD and some ideas about how we could improve it.

Crash Override

An explosion of security startups and the economic climate are colliding and going to result in a train wreck. This post dives deeper in this that a recent short post in LinkedIn.

In this post I share lessons from my degree in info lessons earned in the real world after I left, told with some colourful real anecdotes

This post focuses on using SBOMs and vulnerability data and explains why most vulnerability data is not up to the job.

We asked over 50 leading CSOs and appsec leaders what their biggest unsolved problems were and then sat back and listened. This is what we heard.