Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Development teams ship faster than ever with AI-assisted coding. Features that previously took weeks can now be delivered in days. But security testing still runs on the old schedule. In Aikido's 2026 State of AI in Pentesting report, we found that 76% of organizations deploy significant production changes weekly or faster, while just 21% validate security on every release. Katie Norton, Senior Research Manager at IDC, summed it up.

Continuous control monitoring and a once-a-year, point-in-time pentest don't sit well together. A manual test means scoping, waiting for a slot, and holding up the audit window for the report. Teams choose Drata to get audit-ready quickly: controls monitored continuously, evidence collected automatically. The pentest is the part that doesn't move at that speed.

Any SCA tool worth its salt has reachability analysis these days. When a dependency has a known vulnerability, these tools can tell you whether your code calls the affected function. This is pretty much non-negotiable because it helps teams focus their security efforts instead of sifting through noise. Every other step in prioritizing dependency CVEs builds on it. But just because the vulnerable function is reachable doesn’t mean it’s exploitable.

Aikido Security is now CREST accredited in the penetration testing discipline. As a member of the CREST community, we are recognized as trusted professionals with proven experience and capability.

On 8 October 2026 a threat actor published a compromised version of tensorlake to npm. The compromised version is 0.5.144 and contains a variant of the Shai-Hulud worm, which exfiltrates secrets from infected devices and attempts to self-replicate through connected supply chains. Tensorlake is a serverless sandbox for AI agents and its npm package has a reported lifetime install count of over 100,000.

If you've ever gone through a SOC 2 audit, you know the drill. It’s weeks of screenshotting dashboards and chasing down evidence across some dozen tools, while hoping the auditor doesn't ask a follow-up question you can't answer. Fortunately, SOC 2 doesn't have to be that painful, especially if the tools you already use for security are generating the evidence for you as a byproduct of just doing their job. That's what Aikido Security can do for application and cloud security.

The first deadline of the Cyber Resilience Act went live last week. The Cyber Resilience Act (CRA) is the new EU regulation that defines minimum cybersecurity requirements for all products with digital elements, including their building blocks (hardware and software). It applies to anyone placing products on the EU market, not just companies based there. The full requirements won’t go into effect until the end of next year.

We’ve identified Go malware distributed via at least two Terraform providers and at least two Go Modules. This is the first time we’ve observed malware distributed via Terraform providers. The following packages contain the malware: The malware overlaps with the Graphalgo NPM malware campaign, first reported by ReversingLabs in February 2026, and also reported on in the last week by Safedep, CheckMarx, and JFrog.

Today, pub.dev joins the list of package registries we have found malware on. We detected a variant of XCSSET hiding inside universal_file_viewer (version 0.1.5), a Flutter file preview package on pub.dev with around 500 downloads. This is the first compromised package we have detected on pub.dev, the official package repository for Dart and Flutter. Unlike the recent npm supply chain attacks you might be familiar with, this was not a case of someone deliberately targeting this package.

This post is based on Mackenzie's conversation with Jason Haddix on The Secure Disclosure podcast. Listen to the full episode or watch below. Jason Haddix has topped the Bugcrowd leaderboards, run security as CISO of Ubisoft, and wrote The Bug Hunter's Methodology, the playbook a lot of working pentesters learned from, so his read on the direction of the field is worth listening to. He believes that “90% of pen tests will be done by AI” in the near future.