The AI Compliance Gap No One's Talking About (ISO, NIST, EU AI Act)

Mend.io, formerly known as Whitesource, has over a decade of experience helping global organizations build world-class AppSec programs that reduce risk and accelerate development -– using tools built into the technologies that software and security teams already love. Our automated technology protects organizations from supply chain and malicious package attacks, vulnerabilities in open source and custom code, and open-source license risks.

The coefficient of security friction is slowing teams down. How can you fix it?

Like the sands through the hourglass, so are the days of our SOC lives…. An alert surfaces, and while it doesn’t immediately signal a critical incident, it carries just enough ambiguity to require attention. An analyst opens the investigation, begins pulling in context, reviews authentication activity, pivots into endpoint data, and checks for any corresponding changes in the cloud environment.

Apono vs Entra ID PIM: Building Privileged Access Engineers Will Actually Use Across Cloud

Microsoft Entra ID Privileged Identity Management is designed to bring structure to privileged access inside Microsoft environments. It allows organizations to make roles eligible, require activation, and enforce approval workflows. Within Azure, it performs that role predictably. The challenge begins when engineering workflows extend beyond Azure. Modern infrastructure rarely lives in a single ecosystem.

The Agentic Stack Explained: How LLMs, MCP Servers, and APIs Work Together

The term AI agent is dominant in current cybersecurity discourse. Vendors, analysts, and CISOs all use the label, yet technical confusion remains regarding how agents actually operate and where the security risks reside. Beneath the surface-level familiarity, there is often significant confusion about what an AI agent actually is, how it operates technically, and most importantly for security teams, where the risk actually lives.

Your AppSec Pipeline Is Lying To You: More Vulnerabilities Security

357 crash reports. 2 actual bugs. That is not a typo. That is the reality of modern application security testing. In a recent fuzzing campaign, over a thousand crash files were generated across billions of executions. After crash deduplication and triage, that number collapsed to just two unique issues. Not hundreds of vulnerabilities. Not dozens of risks. Two. And yet, most security teams would have celebrated the initial numbers.

Natoma and 1Password help enterprises scale AI securely with governed agent access

To support enterprise workflows like monitoring systems, triaging support tickets, and automating routine work, AI agents need access to the same sensitive systems employees use, including databases, APIs, SaaS tools, and internal infrastructure. However, many of these systems still rely on shared passwords, API keys, tokens, and other credential-based access paths that are difficult to manage and control.

Enforcing GitHub Repository Backups with Rubrik and GitHub Actions

Your CI pipeline enforces tests, security scans, and policy checks before code hits production. But your backups? Still running on a schedule, completely disconnected from your deployments. In this video, I'll walk you through how to use Rubrik's powerful APIs to build what I'm calling "Backup as Code": a GitHub Action that triggers an on-demand Rubrik snapshot of your GitHub repository every time code is merged into the main branch. We'll look at the action code, wire it up to a live repo, and watch the whole thing run end to end.