Security commentary
2026: The Year Cyberattacks Became Autonomous
How to prepare for attacks that can repeat, adapt and coordinate faster than a manual security queue.
Read guideCounterswarm
Security commentary
Practical perspectives on AI security, code review, software dependencies, and autonomous threats.
Security commentary
Abliteration and the Risks Ahead
Why model refusal behaviour and application security need separate evaluation.
Read guideSecurity commentary
Alignment, Reward Hacking, and Autonomous Cyberattacks
Separate an agent’s objective from the evidence and permissions used to judge its work.
Read guideSecurity commentary
Bug Bounties Are Not Dead
A practical intake and validation process for vulnerability reports in an automated reporting era.
Read guideSecurity commentary
Building the Means to Stay in Control
Design practical control boundaries for AI agents before their workflows become difficult to reverse.
Read guideSecurity commentary
Cybersecurity’s ChatGPT Moment
Turn accessible AI capability into a measurable defensive workflow rather than another unverified alert stream.
Read guideSecurity commentary
Beyond CyberGym: Evaluating Security Agents
Use benchmark results to investigate an agent’s strengths and limits without confusing a score with deployment readiness.
Read guideSecurity commentary
Anatomy of Two Critical PHP Vulnerabilities: How to Assess Exposure
Trace PHP runtime exposure, verify vendor fixes and close the gap between a package update and a protected service.
Read guideSecurity commentary
Preventing Supply Chain Attacks While Agents Work
Control dependency changes and installation behaviour when coding agents can act faster than reviewers.
Read guideSecurity commentary
How Agents Can Improve Reachability Analysis in the Software Supply Chain
Connect dependency inventory to code paths while preserving uncertainty about runtime behaviour.
Read guideSecurity commentary
Reachable Doesn’t Mean Exploitable
Use a chain of explicit conditions to distinguish a code path from a demonstrated security impact.
Read guideSecurity commentary
Securing the World’s Software in the Age of AI
Make continuous defensive work practical across applications, dependencies and the teams responsible for them.
Read guideSecurity commentary
General AI vs. Security-Focused Code Reviews
Match review methods to the security property being checked and judge findings by evidence rather than volume.
Read guideSecurity commentary
Why Defenders Can’t Bet on One Model
Design model selection around measured tasks, reliable tools and evidence that survives a provider change.
Read guide
