|
By Andrea Mazzarini
This executive intelligence briefing covers two distinct horizons: the past week (12–19 August 2026) and the past month (approximately 20 July–19 August 2026). It prioritizes AppSec, software supply chain, state-actor activity, cloud/IaC, identity, ransomware resilience, and regulatory developments with board-level implications. Analysis focuses on residual risk, control effectiveness, and business enablement rather than volume metrics alone.
|
By Pete Zavlaris
The amount of code being generated in the era of AI is staggering, and some non-trivial percentage of that code is insecure. According to the 2026 GenAI Code Security Report, roughly 44% of AI generated code test produced a known vulnerability. Organizations are more reliant than ever on cybersecurity programs that can scale at the velocity of AI while still managing risk with guardrails, governance, and compliance standards.
|
By Chris Wysopal
Veracode I have been going to Black Hat for more than 25 years, and I have spent many of those years on the Review Board. New technologies keep changing the shape of the systems we secure. The questions I find myself asking stay remarkably familiar. Where does untrusted data enter? What authority does a component have? Which boundary controls a sensitive operation? How do we know that control worked?
|
By Natalie Tischler
Many tools fail to adapt to diverse developer use cases, leading to workflow interruptions in IDEs and CI pipelines. Managing dependencies for multi-module projects can be complex and time-consuming, often causing delays. And developers frequently work across varied environments – whether it’s IDEs, CI pipelines, or repositories, each with unique requirements. These challenges create friction and slow down the development process, making it harder to deliver secure applications on time.
|
By Andrea Mazzarini
Senior security leadership continues to confront a dual acceleration: self-propagating software supply-chain worms that weaponize developer credentials at unprecedented velocity, and the persistent security debt introduced by AI-generated code. This briefing synthesizes material developments across the most recent seven days and the preceding thirty days, framed strictly around residual risk, control effectiveness, and business enablement.
|
By Andrea Mazzarini
This briefing synthesizes verified threat activity, vulnerability disclosures, supply-chain incidents, and regulatory signals into a board-ready assessment of residual risk and control effectiveness for the period of 29 June to 28 July 2026. The analysis prioritizes AppSec, software supply chain, identity, cloud/IaC, API/web, ransomware resilience, and AI-related exposure.
|
By Natalie Tischler
New GenAI code security research shows a stubborn truth: as AI is generating more of the code entering production, secure output is not improving at the same pace. The result is a GenAI code security challenge defined by scale, model choice, and the growing need for verification. AI coding has moved past experimentation. For many teams, it is now part of how software gets built every day. That’s the opportunity. It’s also the risk.
|
By Natalie Tischler
For a long time, compliance meant paperwork. Fill out the right forms, pass the annual audit, file it away. Done. Now, your development pipeline is generating code at a pace no human team can review manually, your supply chain runs three layers deep into open-source packages and AI plugins you didn’t choose, and regulators are watching in real time. The old approach doesn’t just underperform; it creates a false sense of security.
|
By Andrea Mazzarini
This briefing analyzes verified developments over two horizons: the Past Week (July 15–21, 2026) and the Past Month (June 22–July 21, 2026). It draws exclusively from contemporaneous incident disclosures, threat research, and authoritative reporting. Analysis emphasizes material business risk, control effectiveness gaps, residual exposure in software supply chains, cloud/IaC environments, identity-adjacent vectors, and AI-adjacent workloads.
|
By Karen Buffo
For years, the application security testing tool category was defined by a simple question: can it find vulnerabilities? The better the scanner, the better the tool. That model made sense (for the most part) when humans wrote every line of code and security teams could reasonably review what developers shipped. That model is now obsolete.
|
By VERACODE
In this episode, hosts Ryan and Brian are joined by Johnny Wong, VP of Solutions Architecture at Veracode, to explore how AI-assisted “vibe coding” is changing the way software gets built—and the new security risks that come with it. While large language models are making developers faster and more productive, studies shared in the discussion show that a significant portion of AI-generated code still contains security vulnerabilities, raising concerns about scale and speed in modern development pipelines.
|
By VERACODE
In the year 2079, vulnerabilities are endless and breaches are a daily reality. Jordan Kodak, a weary engineer, dreams of a world where developers can innovate without fear. She leaves Earth in search of Secura Prime—a legend of flawless code—and decades later receives a distress signal from a temporal anomaly. Meet Cipher, a sentinel from 2177, where secure coding finally took root. Armed with future knowledge, Jordan realizes the utopia she sought isn’t a place… it’s a practice.
|
By VERACODE
With AI tools, **everyone** is becoming a developer. Marketing teams, finance teams, and business users are now building applications and generating code. So the big question is: In this clip, Tim Brown, CISO in Residence at Team8 and former CISO at Solarwinds, discusses the shift happening in organizations and why strong guardrails are more important than ever in the AI-coding era. Subscribe for more insights on Application Security, AI Coding, and DevSecOps.
|
By VERACODE
In the age of AI coding, annual audits and snapshots are no longer enough. Discover **Continuous Attestation** — the practice of producing ongoing, verifiable evidence that your applications and pipelines are always running in a trusted, policy-conformant state. In this video, Anthony Barkley, Chief Strategy Officer at Veracode, explains why independence in attestation is critical for earning trust from regulators, customers, and boards — especially when AI agents are writing code.
|
By VERACODE
Is your organization generating up to 80% of its new code with AI? You might be proud of the speed — but are you ready for the security risks? In this video, we reveal the hidden danger: multiple studies show that **40-50% of AI-generated code changes contain vulnerabilities**. Discover why AI coding is accelerating development faster than ever — and why traditional security approaches are no longer enough.
|
By VERACODE
Struggling with inefficient secure coding workflows, lack of visibility into developer actions, and growing security debt? In this clip, Christian Dalomba breaks down the biggest challenges organizations face with secure development and shows how Veracode Fix Analytics helps you move beyond just finding vulnerabilities to actually fixing them faster and smarter. Key takeaways.
|
By VERACODE
As AI accelerates software development at machine speed, security teams are struggling to keep up with remediation. In this insightful interview, Veracode CISO Sohail Iqbal breaks down the security realities of AI-assisted coding and shares how organizations can close the growing gap between code velocity and secure deployment.
|
By VERACODE
How do you scale a world-class tech company while staying ahead in application security and AI-driven innovation? In this powerful exclusive interview on The Vlad Kachur Show, Brian Roche, CEO of Veracode, breaks down exactly how he transformed Veracode into one of the globe's leading application security platforms trusted by enterprises worldwide.
|
By VERACODE
-- - Discover the latest game-changing updates to the Veracode Application Risk Management Platform! We're making it easier than ever to embed security seamlessly into your workflows and secure software faster. In this teaser, get a quick overview of the most exciting new features.
|
By VERACODE
Hear from Veracode's SVP of Business Operations, Sarah Law, on how developers face immense pressure to deliver software quickly while security and compliance teams struggle to keep pace with constant changes. The Veracode platform addresses this challenge by discovering and organizing all technology assets across systems, then assessing the risk associated with each one. What sets Veracode apart is its built-in governance and unified, configurable policy framework that adapts to each customer's unique security posture and regulatory requirements.
|
By Veracode
While shifting security left in your software development lifecycle is crucial to application security success, it's still imperative to maintain testing in the later stages of your process. After all, some web application vulnerabilities can only be discovered at that point in the SDLC.
|
By Veracode
With a comprehensive AppSec program, you want to understand your entire development, security, and application footprint so you can roll out consistent tools and processes. As a result, only a portion of your applications are covered, leaving vulnerabilities unprotected. And blind spots are clouding visibility into risk reduction efforts, making it difficult to report on progress throughout your organization.
|
By Veracode
Veracode Static Analysis provides fast, automated security feedback to developers; conducts a full policy scan before deployment; and gives clear guidance on what issues to focus on and how to fix them faster.
|
By Veracode
You want AppSec tools in your development process, but anything less than full integration undermines your program's effectiveness. Getting the right resources into developers' hands typically requires: tools, systems, and processes. Ongoing maintenance: Routine patches and upgrades can be time consuming-especially if you're supporting multiple geographies or teams-and may break your customizations.
|
By Veracode
In a world where time is money, companies are required to churn out software quickly or get left in the dust. To stay ahead of the market, developers are turning towards open source code, which - when secure - can be a valuable asset towards their efforts
|
By Veracode
Developers want to create secure code, but lack training, so they must rely on AppSec experts to create secure applications. But the severe cybersecurity talent shortage leads to: As a result, developers are often conducting their own security research, which takes substantial time, increasing software delays and costs. With Veracode, you enable developers to write secure code and decrease flaws, so you can make your developers security self-sufficient.
|
By Veracode
Veracode Security Labs shifts application security knowledge "left," earlier in the development cycle, through guided, interactive exercises that train developers to tackle modern threats in the evolving cybersecurity landscape and deliver secure code on time.
|
By Veracode
Today, most organizations are in a race to deliver new, innovative software before their competitors. In turn, they have gone from bi-annual software releases to daily, hourly, or even by-the-minute releases. To keep up with these rapid deployments, security has had to shift from being a late-stage blocker, to an integrated part of the development process. Developers have been doing their best to implement these security measures, but since their performance is often tied to the rate of deployments, speed tends to take precedence. As a security professional, what are some steps you can take so that security doesn't take a back seat to speed?
- August 2026 (7)
- July 2026 (13)
- June 2026 (9)
- May 2026 (10)
- April 2026 (11)
- March 2026 (9)
- February 2026 (12)
- January 2026 (7)
- December 2025 (13)
- November 2025 (9)
- October 2025 (10)
- September 2025 (11)
- August 2025 (12)
- July 2025 (8)
- June 2025 (11)
- May 2025 (8)
- April 2025 (6)
- March 2025 (3)
- February 2025 (6)
- January 2025 (2)
- December 2024 (1)
- November 2024 (3)
- October 2024 (3)
- September 2024 (7)
- August 2024 (2)
- July 2024 (7)
- June 2024 (9)
- May 2024 (5)
- April 2024 (6)
- March 2024 (7)
- February 2024 (6)
- January 2024 (7)
- December 2023 (8)
- November 2023 (8)
- October 2023 (4)
- September 2023 (9)
- August 2023 (4)
- July 2023 (4)
- June 2023 (7)
- May 2023 (5)
- April 2023 (3)
- March 2023 (5)
- February 2023 (4)
- January 2023 (7)
- December 2022 (3)
- November 2022 (9)
- October 2022 (11)
- September 2022 (9)
- August 2022 (9)
- July 2022 (8)
- June 2022 (3)
- May 2022 (7)
- April 2022 (8)
- March 2022 (7)
- February 2022 (8)
- January 2022 (2)
- December 2021 (11)
- November 2021 (9)
- October 2021 (3)
- September 2021 (7)
- August 2021 (5)
- July 2021 (7)
- June 2021 (20)
- May 2021 (15)
- April 2021 (26)
- March 2021 (13)
- February 2021 (11)
- January 2021 (11)
- December 2020 (19)
- November 2020 (7)
- October 2020 (14)
- September 2020 (13)
- August 2020 (19)
- July 2020 (15)
- June 2020 (7)
- May 2020 (7)
Veracode delivers the application security solutions and services today’s software-driven world requires. Veracode’s unified platform assesses and improves the security of applications from inception through production so that businesses can confidently innovate with the web and mobile applications they build, buy and assemble as well as the components they integrate into their environments.
Veracode’s powerful cloud-based platform, deep security expertise, and systematic, policy-based approach provide enterprises with a simpler and more scalable way to reduce application-layer risk across their global software infrastructures.
The Veracode Solution:
- Overcoming DevSecOps Challenges: Innovating through software holds many promises but also bears risks. AppSec programs often struggle with the same problems:
- Some solutions are hard to manage and scale.
- Developers are not empowered to fix security issues.
- Security teams lack bandwidth to manage DevSecOps programs.
- Delivered Through SaaS: Our SaaS model delivers a better, more scalable service at a lower cost. Because we've analyzed over 10 trillion lines of code, Veracode is able to provide the fastest path to accuracy - without tuning. Our expertise is based on analyzing customer programs for over a decade.
- Application Analysis: Veracode simplifies AppSec programs by combining five application security analysis types in one solution, all integrated into the development pipeline.
- Developer Enablement: Most AppSec programs forget that there is only one team that can fix security findings: the development team. Veracode provides developers with security feedback in their IDE in seconds as they are writing code, helping them learn on the job.
- AppSec Governance: AppSec programs can only be successful if all stakeholders value and support them. That’s why Veracode helps security teams to demonstrate the value of AppSec.
Manage Your Entire Application Security Program in a Single Platform.