Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The latest News and Information on Application Security including monitoring, testing, and open source.

Embeddings vs. Generative Models #AI #RAG #AIExplained #MachineLearning #OpenAI #LLMs #AIsecurity

Not all AI models are made to generate. Some are built to understand. Here’s the key difference: Generative models take in text and produce new text (think ChatGPT). Embedding models take in text and translate it into numbers, vectors that capture meaning. Why does that matter? Because embedding models let you turn documents into searchable vectors. That means when someone asks a question, you don’t need to search the whole doc, you just find the most relevant chunks based on meaning. And that’s what makes things like RAG (Retrieval-Augmented Generation) powerful and efficient.

SOC: Does Your Company Need One? (Budget vs. Protection) #soc #cybersecurity

At what point should a company invest in a Security Operations Center (SOC)? Learn when businesses should start thinking seriously about building cybersecurity defenses—and why protecting revenue is just as critical as generating it. Many companies wait too long to prioritize cybersecurity. Discover why having a SOC isn't just for giant enterprises—and why protecting your revenue must be part of your business growth strategy from the start.

SolarWinds Hack: How State Actors Infiltrated & What You Can Learn #cybersecurity #solarwinds

State actors played the long game by targeting SolarWinds’ build server, injecting malicious code without detection. Learn why code diffs, hash checks, and decompiling builds are critical for cybersecurity today.

Build Trust Now: Transparent Dialogue for a Trustworthy Organization #trust #cybersecurity

Building trust shouldn't start when there's already a problem. Learn how to proactively create transparent, trust-first conversations with customers—and why trust must be engineered into your security programs from the start. Building trust isn't reactive—it’s proactive. Discover how to open transparent conversations before issues arise, why trust must be built into every layer of your security program, and how to communicate that trust effectively during the sales process.

RATatouille: A Malicious Recipe Hidden in rand-user-agent (Supply Chain Compromise)

On 5 May, 16:00 GMT+0, our automated malware analysis pipeline detected a suspicious package released, rand-user-agent@1.0.110. It detected unusual code in the package, and it wasn’t wrong. It detected signs of a supply chain attack against this legitimate package, which has about ~45.000 weekly downloads.

Dynamic Application Security Testing: DAST Basics

DAST is a security tool that attempts to penetrate an application from the outside by checking its exposed interfaces for vulnerabilities and flaws. Sometimes called a web application vulnerability scanner, it is a type of black-box security test. It looks for security vulnerabilities by simulating external attacks on an application while the application is running.

7 Core Principles of an Effective Application Security Program

If you’re building software, chances are your environment looks nothing like it did a few years ago. Monolithic applications have given way to microservices. On-prem systems have migrated to multi-cloud. Waterfall has become agile, and developers are pushing code daily (sometimes hourly). Security, meanwhile, is still catching up.

Securing AI Isn't Just About Your Pipeline #AIsecurity #DevSecOps #AppSec #redteaming

Building AI apps securely is not just about plugging tools into your dev pipeline. It’s about knowing what to do with those tools after they give you results. What risks matter? What policies should you apply? And when is the right time to integrate AI security into your CI/CD? Bar-El Tayouri sits down with Ashish Rajan from The Cloud Security Podcast to discuss why red teaming and scanning aren’t enough and how getting comfortable with AI security before production pays off long-term.

XRP supply chain attack: Official NPM package infected with crypto stealing backdoor

At 21 Apr, 20:53 GMT+0, our system, Aikido Intel started to alert us to five new package version of the xrpl package. It is the official SDK for the XRP Ledger, with more than 140.000 weekly downloads. We quickly confirmed the official XPRL (Ripple) NPM package was compromised by sophisticated attackers who put in a backdoor to steal cryptocurrency private keys and gain access to cryptocurrency wallets.

Introducing a new Application Security experience

Welcome to Cloudflare Security Week 2025! During this year's Security Week, we are boosting security with AI-driven insights, better threat detection, and stronger protections against emerging risks. Our aim is to empower customers with more intuitive and user-friendly solutions to protect their data and applications in an increasingly complex environment. In this episode, tune in for a conversation with Cloudflare's Jessica Tarasoff, Product Design Lead, and Pete Thomas, Senior Manager, Product Design.