Frameworks, analysis, and guidance across TPRM, supply chain risk, and vendor governance.
Software Supply Chain SecurityWhen GitHub re-enabled two compromised Actions on September 16 without cleaning their malicious payloads, workflows resumed executing Mini Shai-Hulud code for nine days. This incident exposed roughly
Incident ManagementWhen American Medical Collection Agency (AMCA) failed in its security controls, Labcorp faced a $2.3 million settlement and court-mandated security reforms after 10.2 million customer records were exp
Incident ManagementWhen BigCommerce confirmed that compromised credentials for third-party Ribon applications had been used to inject malicious scripts into merchant stores on September 17, it highlighted a critical vul
Software Supply Chain SecurityWhen your open-source dependency gets compromised, you have about 72 hours to contain the damage before it worsens. CrowdSec s May 2026 breach, which exposed around 300 repositories through a compromi
Get weekly security insights and compliance updates delivered to your inbox.
Regulatory FrameworksThe Problem: Meeting DORA s Demands With DORA enforceable across the EU starting January 2025, your team has likely updated contracts, documented incident procedures, and classified third-party arrang
Software Supply Chain SecurityA recent Checkmarx report uncovered a new npm malware campaign using blockchain for command-and-control (C2) operations. This campaign affected nine packages, with one reaching over 1.9 million downlo
Software Supply Chain SecurityThe Problem A malicious npm package called indexed-btree managed to reach 2 million weekly downloads by hiding its loader inside a normal runtime method, evading most supply chain defenses. GitHub s n
Incident ManagementWhat Happened In September 2025, a ransomware attack forced Jaguar Land Rover to shut down its UK plants, halting production of about 1,000 luxury vehicles per day. This disruption affected over 5,000
Incident ManagementWhen Brevo s compromised Cloudflare API key went undetected from late August until it was weaponized on September 14, the company joined a growing list of organizations that discovered their third-par
Incident ManagementYou ve secured your source repositories. Your API keys live in private repos, not public ones. Your CDN handles the edge logic. You re covered, right? That s what Brevo thought before attackers used a
Incident ManagementYour logistics team just confirmed a carrier for tomorrow s pickup. The account matched your approved list, the email domain looked right, and the phone number was in your system. However, criminals r
Monitoring & PerformanceThe Visibility Gap Your team can see disruptions. Real-time dashboards flag capacity constraints, border closures, and rate spikes. But between identifying the problem and solving it, there s a gap. Y
Supply Chain MappingYou re drowning in dashboards. Your team tracks hundreds of metrics across vendor portals, ERPs, and risk platforms. Yet when executives ask whether a critical supplier poses concentration risk or if
Incident ManagementThe Problem Your vendor operates a crucial F5 BIG-IP APM device. It s patched and monitored under your standard security controls. Then a rootkit exploits CVE-2025-53521, injecting a fileless web shel
Software Supply Chain SecurityScope This guide explores the technical and governance challenges posed by autonomous AI agent attacks on package management infrastructure, focusing on the May, June 2026 RubyGems incident. It examin
Regulatory FrameworksYou ve got 24 hours from awareness to initial report. That s not a planning window, it s an execution deadline. If you re selling products with digital elements in the EU, the Cyber Resilience Act s A
Software Supply Chain SecurityThe Challenge Imagine receiving a GPG-signed vulnerability report listing 95 issues in your open source project. It follows proper disclosure protocol, arrives at the designated security addresses, an
Incident ManagementWhat Happened On September 5, 2025, The Gentlemen ransomware group listed Veradigm (formerly Allscripts Healthcare Solutions) on its leak site, claiming to hold 3.5 million patient records. The Chicag
Software Supply Chain SecurityThe Conventional Wisdom Your team likely sees AI coding assistants as pure productivity boosters. Developers ship code faster, pull in dependencies quicker, and your velocity metrics improve. The assu
Incident ManagementA data deletion clause is only effective if you enforce it. Trezor s breach shows the consequences of failing to do so: ShipMonk retained customer data for three years after confirming deletion, incre
