Frameworks, analysis, and guidance across TPRM, supply chain risk, and vendor governance.
Incident ManagementWhen BigCommerce confirmed that compromised credentials for third-party Ribon applications had been used to inject malicious scripts into merchant stores on September 17, it highlighted a critical vul
Incident ManagementYou ve secured your source repositories. Your API keys live in private repos, not public ones. Your CDN handles the edge logic. You re covered, right? That s what Brevo thought before attackers used a
Software Supply Chain SecurityThe Challenge Imagine receiving a GPG-signed vulnerability report listing 95 issues in your open source project. It follows proper disclosure protocol, arrives at the designated security addresses, an
Regulatory FrameworksA vendor intake team meeting three weeks after Judge Rita Lin s August 27 ruling overturning Anthropic s supply chain risk designation sparked important questions. The team realized they d been treati
Get weekly security insights and compliance updates delivered to your inbox.
Software Supply Chain SecurityLast week, a question arose in a financial services TPRM Slack channel: How do I assess risk when the vendor is the developer toolchain? This came shortly after the Rust Security Response Team disclos
Ratings & Risk TieringScope - What This Guide Covers This guide tackles the challenge of keeping vendor risk profiles accurate when risk factors change faster than your assessment cycle. It s aimed at analysts responsible
Incident ManagementThe Challenge On June 8, 2017, UpGuard s Cyber Risk Team discovered a publicly accessible Amazon Web Services S3 bucket containing Verizon customer data, names, addresses, account details, and account
